Testimonial Slider Shortcode Vulnerabilities

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sazzad Hu Testimonial Slider Shortcode allows Stored XSS.This issue affects Testimonial Slider Shortcode: from n/a through 1.1.9.

Affected:

up to 1.1.9

Fix:

No patched version reported

Disclosed:

Nov 19, 2024

CVE-2024-51925 on NVD →

The Testimonial Slider Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scri...

CVSS:

6.4

Affected:

up to 1.1.9

Fix:

No patched version reported

Disclosed:

Nov 8, 2024

CVE-2024-51925 on NVD →

[en] The Testimonial Slider Shortcode WordPress plugin before 1.1.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege u...

Affected:

up to 1.1.9

Fixed in:

1.1.9

Disclosed:

Oct 16, 2023

CVE-2023-4795 on NVD →

Update the WordPress Testimonial Slider Shortcode plugin to the latest available version (at least 1.1.9). Unknown discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Testimonial Slider Shortcode Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, ad...

Affected:

up to 1.1.9

Fixed in:

1.1.9

Disclosed:

Sep 15, 2023

The Testimonial Slider Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcode attributes in versions up to, and including, 1.1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above...

CVSS:

6.4

Affected:

up to 1.1.9

Fixed in:

1.1.9

Disclosed:

Sep 12, 2023

CVE-2023-4795 on NVD →

The Testimonial Slider Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcode attributes in versions up to, and including, 1.1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above...

Affected:

up to 1.1.9

Fixed in:

1.1.9

Disclosed:

Sep 12, 2023