CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-4193 – Testimonial Slider <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2024-4193
The Testimonial Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'testimonialcategory' shortcode in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. El complemento Testimonial Slider para WordPress es vulnerable a Cross-Site Scripting Almacenado a través del código corto 'testimonialcategory' en todas las versiones hasta la 1.3.2 incluida debido a una sanitización de entrada insuficiente y a un escape de salida en los atributos proporcionados por el usuario. Esto hace posible que atacantes autenticados, con acceso de nivel de colaborador y superior, inyecten scripts web arbitrarios en páginas que se ejecutarán cada vez que un usuario acceda a una página inyectada. • https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3080579%40testimonial-slider&new=3080579%40testimonial-slider&sfp_email=&sfph_mail= https://www.wordfence.com/threat-intel/vulnerabilities/id/cd7ed687-4049-4957-86e9-b2f59621c747?source=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.4EPSS: 0%CPEs: 1EXPL: 1CVE-2024-1746 – Testimonial Slider < 2.3.8 - Admin+ Stored XSS
https://notcve.org/view.php?id=CVE-2024-1746
The Testimonial Slider WordPress plugin before 2.3.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) El complemento Testimonial Slider de WordPress anterior a 2.3.8 no sanitiza ni escapa a algunas de sus configuraciones, lo que podría permitir a usuarios con privilegios elevados, como el administrador, realizar ataques de Cross-Site Scripting Almacenado incluso cuando la capacidad unfiltered_html no está permitida (por ejemplo, en una configuración multisitio). The Testimonial Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.3.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. • https://wpscan.com/vulnerability/5f35572a-4129-4fe0-a465-d25f4c3b4419 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 1CVE-2024-1745 – Testimonial Slider < 2.3.7 - Author+ Settings Update
https://notcve.org/view.php?id=CVE-2024-1745
The Testimonial Slider WordPress plugin before 2.3.7 does not properly ensure that a user has the necessary capabilities to edit certain sensitive Testimonial Slider WordPress plugin before 2.3.7 settings, making it possible for users with at least the Author role to edit them. El complemento Testimonial Slider de WordPress anterior a 2.3.7 no garantiza adecuadamente que un usuario tenga las capacidades necesarias para editar ciertas configuraciones sensibles del complemento Testimonial Slider de WordPress anterior a 2.3.7, lo que hace posible que los usuarios con al menos el rol de Autor puedan editarlas. The Testimonial Slider plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tssSettingsUpdate() function in all versions up to, and including, 2.3.6. This makes it possible for authenticated attackers, with author-level access and above, to update the plugin's settings. • https://wpscan.com/vulnerability/b63bbfeb-d6f7-4c33-8824-b86d64d3f598 • CWE-862: Missing Authorization •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-44741 – WordPress Testimonial Slider plugin <= 1.3.1 - Cross-Site Request Forgery (CSRF) vulnerability
https://notcve.org/view.php?id=CVE-2022-44741
Cross-Site Request Forgery (CSRF) vulnerability leading to Cross-Site Scripting (XSS) in David Anderson Testimonial Slider plugin <= 1.3.1 on WordPress. Vulnerabilidad de Cross-Site Request Forgery (CSRF) que conduce a Cross-Site Scripting (XSS) en el complemento David Anderson Testimonial Slider de Wordpress en versiones <= 1.3.1. The Testimonial Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.1. This is due to missing nonce validation on the testimonial_update_review_me() function. This makes it possible for unauthenticated attackers to inject malicious JavaScript, granted they can trick a site administrator into performing an action such as clicking on a link. • https://patchstack.com/database/vulnerability/testimonial-slider/wordpress-testimonial-slider-plugin-1-3-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve https://wordpress.org/plugins/testimonial-slider • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2021-36851 – WordPress Testimonial Slider plugin <= 3.5.8.3 - Cross-Site Scripting (XSS) vulnerability
https://notcve.org/view.php?id=CVE-2021-36851
Authenticated (editor or higher user role) Cross-Site Scripting (XSS) vulnerability in Web-Settler Testimonial Slider – Free Testimonials Slider Plugin (WordPress plugin) via parameters mpsp_posts_bg_color, mpsp_posts_description_color, mpsp_slide_nav_button_color. Una vulnerabilidad de tipo Cross-Site Scripting (XSS) Autenticada (rol de editor o usuario superior) en Web-Settler Testimonial Slider - Free Testimonials Slider Plugin (plugin de WordPress) por medio de los parámetros mpsp_posts_bg_color, mpsp_posts_description_color, mpsp_slide_nav_button_color • https://patchstack.com/database/vulnerability/testimonial-add/wordpress-testimonial-slider-plugin-3-5-8-3-cross-site-scripting-xss-vulnerability https://wordpress.org/plugins/testimonial-add/#developers • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •