Easy Testimonial Rotator Vulnerabilities

[en] The Easy Testimonial Slider and Form plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 1.0.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authentic...

Affected:

up to 1.0.3

Fixed in:

1.0.3

Disclosed:

Oct 29, 2025

CVE-2015-10147 on NVD →

The Easy Testimonial Slider and Form plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 1.0.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated...

CVSS:

4.9

Affected:

up to 1.0.2

Fixed in:

1.0.3

Disclosed:

Oct 28, 2025

CVE-2015-10147 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in I Thirteen Web Solution Easy Testimonial Slider and Form allows Stored XSS.This issue affects Easy Testimonial Slider and Form: from n/a through 1.0.18.

Affected:

up to 1.0.19

Fixed in:

1.0.19

Disclosed:

Oct 24, 2023

CVE-2023-45754 on NVD →

The Easy Testimonial Slider and Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via settings in versions up to, and including, 1.0.18 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to injec...

CVSS:

4.4

Affected:

up to 1.0.18

Fixed in:

1.0.19

Disclosed:

Oct 12, 2023

CVE-2023-45754 on NVD →

[en] Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution Easy Testimonial Slider and Form plugin <= 1.0.15 versions.

Affected:

up to 1.0.16

Fixed in:

1.0.16

Disclosed:

May 8, 2023

CVE-2022-46799 on NVD →

The Easy Testimonial Slider and Form plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search_term' parameter in versions up to, and including, 1.0.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scri...

CVSS:

6.1

Affected:

up to 1.0.15

Fixed in:

1.0.16

Disclosed:

Mar 2, 2023

CVE-2022-46799 on NVD →