Hms Testimonials Vulnerabilities

[en] Multiple cross-site scripting (XSS) vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) image, (3) url, or (4) testimonial parameter to the Testimonial form (hms-testimonials-addnew page); (5) date_format par...

Affected:

up to 2.0.11

Fixed in:

2.0.11

Disclosed:

Jan 30, 2020

CVE-2013-4241 on NVD →

[en] Multiple cross-site request forgery (CSRF) vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) add new testimonials via the hms-testimonials-addnew page, (2) add new groups via the hms-testimonials-ad...

Affected:

up to 2.0.11

Fixed in:

2.0.11

Disclosed:

Apr 2, 2014

CVE-2013-4240 on NVD →

Multiple cross-site request forgery (CSRF) vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) add new testimonials via the hms-testimonials-addnew page, (2) add new groups via the hms-testimonials-addnewg...

CVSS:

7.1

Affected:

up to 2.0.11

Fixed in:

2.0.11

Disclosed:

Aug 8, 2013

CVE-2013-4240 on NVD →

Multiple cross-site scripting (XSS) vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) image, (3) url, or (4) testimonial parameter to the Testimonial form (hms-testimonials-addnew page); (5) date_format paramete...

CVSS:

6.1

Affected:

up to 2.0.11

Fixed in:

2.0.11

Disclosed:

Aug 8, 2013

CVE-2013-4241 on NVD →