Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
242 results · page 3 of 5
Jul 15, 2025Strong Testimonials: Stored Cross-Site ScriptingCVE-2025-7367 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Testimonial Custom Fields in all versions up to, and including, 3.2.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Strong Testimonials
- Affected
- up to 3.2.11
- What to do
- Affects up to 3.2.11. Update Strong Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 4, 2025Testimonials Showcase: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49245 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cmoreira Testimonials Showcase testimonials-showcase allows Reflected XSS.This issue affects Testimonials Showcase: from n/a through <= 1.9.16.
- Product
- Testimonials Showcase
- Affected
- up to 1.9.16
- What to do
- Affects up to 1.9.16. Update Testimonials Showcase to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 10, 2025Jetimob Plataforma Imobiliaria 20240627-0 is vulnerable to Cross Site Scripting (XSS) in the "Pessoas" (persons) section via the field "Profisso" (professor).CVE-2024-41505 · Other software · Jetimob · reported by MITREMedium 6.1
Jetimob Plataforma Imobiliaria 20240627-0 is vulnerable to Cross Site Scripting (XSS) in the "Pessoas" (persons) section via the field "Profisso" (professor).
- Product
- Imobiliaria
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Jetimob Plataforma Imobiliaria 20240627-0 is vulnerable to Cross Site Scripting (XSS).CVE-2024-41504 · Other software · Jetimob · reported by MITREMedium 6.1
Jetimob Plataforma Imobiliaria 20240627-0 is vulnerable to Cross Site Scripting (XSS). In the "Oportunidades" (opportunities) section of the application when creating or editing an "Atividade" (activity), the form field "Descrico" allows injection of JavaScript.
- Product
- Imobiliaria
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Jetimob Plataforma Imobiliaria 20240627-0 is vulnerable to Cross Site Scripting (XSS) in the field "Ttulo" (title) inside the filter Save option in the "Busca" CVE-2024-41503 · Other software · Jetimob · reported by MITREMedium 6.1
Jetimob Plataforma Imobiliaria 20240627-0 is vulnerable to Cross Site Scripting (XSS) in the field "Ttulo" (title) inside the filter Save option in the "Busca" (search) function.
- Product
- Imobiliaria
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Jetimob Plataforma Imobiliaria 20240627-0 is vulnerable to Cross Site Scripting (XSS) via the form field "Observaces" (observances) in the "Pessoas" (persons) sCVE-2024-41502 · Other software · Jetimob · reported by MITREMedium 6.1
Jetimob Plataforma Imobiliaria 20240627-0 is vulnerable to Cross Site Scripting (XSS) via the form field "Observaces" (observances) in the "Pessoas" (persons) section when creating or editing either a legal or a natural person.
- Product
- Imobiliaria
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2025Testimonials Showcase: Missing AuthorizationCVE-2025-49246 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in cmoreira Testimonials Showcase testimonials-showcase allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Testimonials Showcase: from n/a through <= 1.9.16.
- Product
- Testimonials Showcase
- Affected
- up to 1.9.16
- What to do
- Affects up to 1.9.16. Update Testimonials Showcase to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 3, 2025Memory corruption while processing INIT and multimode invoke IOCTL calls on FastRPC.CVE-2025-21485 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory corruption while processing INIT and multimode invoke IOCTL calls on FastRPC.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2025Valtimo is a platform for Business Process Automation.CVE-2025-48881 · Other software · valtimo-platform · reported by GitHubHigh 8.3
Valtimo is a platform for Business Process Automation. In versions starting from 11.0.0.RELEASE to 11.3.3.RELEASE and 12.0.0.RELEASE to 12.12.0.RELEASE, all objects for which an object-management configuration exists can be listed, viewed, edited, created or deleted by unauthorised users. If object-urls are exposed via other channels, the contents of these objects can be viewed independent of object-management configurations. This issue has been patched in version 12.13.0.RELEASE. A workaround for this issue involves overriding the endpoint security as defined in ObjectenApiHttpSecurityConfigurer and ObjectManagementHttpSecurityConfigurer. Depending on the implementation, this could result in loss of functionality.
- Product
- valtimo-backend-libraries
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2025GS Testimonial Slider: Improper Control of Generation of Code ('Code Injection')CVE-2025-47481 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Control of Generation of Code ('Code Injection') vulnerability in GS Plugins GS Testimonial Slider gs-testimonial allows Code Injection.This issue affects GS Testimonial Slider: from n/a through <= 3.2.9.
- Product
- GS Testimonial Slider
- Affected
- up to 3.2.9
- What to do
- Affects up to 3.2.9. Update GS Testimonial Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025GS Testimonial Slider: Missing AuthorizationCVE-2025-47467 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in GS Plugins GS Testimonial Slider gs-testimonial allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GS Testimonial Slider: from n/a through <= 3.3.0.
- Product
- GS Testimonial Slider
- Affected
- up to 3.3.0
- What to do
- Affects up to 3.3.0. Update GS Testimonial Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 18, 2025Incorrect access control in Orban OPTIMOD 5950 Firmware v1.0.0.2 and System v2.2.15 allows attackers to bypass authentication and gain Administrator privileges.CVE-2025-28229 · Other software · Orban · reported by MITRECritical 9.8
Incorrect access control in Orban OPTIMOD 5950 Firmware v1.0.0.2 and System v2.2.15 allows attackers to bypass authentication and gain Administrator privileges.
- Product
- Optimod 5950 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025Real Testimonials: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22269 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShapedPlugin LLC Real Testimonials testimonial-free allows Stored XSS.This issue affects Real Testimonials: from n/a through <= 3.1.6.
- Product
- Real Testimonials
- Affected
- up to 3.1.6
- What to do
- Affects up to 3.1.6. Update Real Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 11, 2025Testimonial Slider And Showcase Pro: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-32656 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RadiusTheme Testimonial Slider And Showcase Pro testimonial-slider-showcase-pro allows PHP Local File Inclusion.This issue affects Testimonial Slider And Showcase Pro: from n/a through <= 2.3.15.
- Product
- Testimonial Slider And Showcase Pro
- Affected
- up to 2.3.15
- What to do
- Affects up to 2.3.15. Update Testimonial Slider And Showcase Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 3, 2025Testimonial Slider: Deserialization of Untrusted DataCVE-2025-30889 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in PickPlugins Testimonial Slider testimonial allows Object Injection.This issue affects Testimonial Slider: from n/a through <= 2.0.13.
- Product
- Testimonial Slider
- Affected
- up to 2.0.13
- What to do
- Affects up to 2.0.13. Update Testimonial Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Social proof testimonials and reviews by Repuso: Missing AuthorizationCVE-2025-31886 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Repuso Social proof testimonials and reviews by Repuso social-testimonials-and-reviews-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Social proof testimonials and reviews by Repuso: from n/a through <= 5.21.
- Product
- Social proof testimonials and reviews by Repuso
- Affected
- up to 5.21
- What to do
- Affects up to 5.21. Update Social proof testimonials and reviews by Repuso to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025Elfsight Testimonials Slider: Cross-Site Request Forgery (CSRF)CVE-2025-31588 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in elfsight Elfsight Testimonials Slider elfsight-testimonials-slider allows Cross Site Request Forgery.This issue affects Elfsight Testimonials Slider: from n/a through <= 1.0.1.
- Product
- Elfsight Testimonials Slider
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Elfsight Testimonials Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025Elfsight Testimonials Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31587 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in elfsight Elfsight Testimonials Slider elfsight-testimonials-slider allows Stored XSS.This issue affects Elfsight Testimonials Slider: from n/a through <= 1.0.1.
- Product
- Elfsight Testimonials Slider
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Elfsight Testimonials Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025Elfsight Testimonials Slider: Missing AuthorizationCVE-2025-31584 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in elfsight Elfsight Testimonials Slider elfsight-testimonials-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elfsight Testimonials Slider: from n/a through <= 1.0.1.
- Product
- Elfsight Testimonials Slider
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Elfsight Testimonials Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 26, 2025TBTestimonials: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26584 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Travis Ballard TBTestimonials tb-testimonials allows Reflected XSS.This issue affects TBTestimonials: from n/a through <= 1.7.3.
- Product
- TBTestimonials
- Affected
- up to 1.7.3
- What to do
- Affects up to 1.7.3. Update TBTestimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Strong Testimonials: Missing AuthorizationCVE-2025-26975 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Strong Testimonials: from n/a through <= 3.2.3.
- Product
- Strong Testimonials
- Affected
- up to 3.2.3
- What to do
- Affects up to 3.2.3. Update Strong Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 18, 2025Super Testimonials: Stored Cross-Site ScriptingCVE-2024-13704 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Super Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'st_user_title' parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Super Testimonials
- Affected
- up to 4.0.1
- What to do
- Affects up to 4.0.1. Update Super Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 10, 2025An arbitrary file upload vulnerability in the component /userPicture of Timo v2.0.3 allows attackers to execute arbitrary code via uploading a crafted file.CVE-2024-57407 · Other software · reported by MITREHigh 7.3
An arbitrary file upload vulnerability in the component /userPicture of Timo v2.0.3 allows attackers to execute arbitrary code via uploading a crafted file.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgitee.com
Feb 4, 2025WP Projects Portfolio with Client Testimonials: Does not have CSRF check in some placesCVE-2024-13115 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Projects Portfolio with Client Testimonials WordPress plugin through 3.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- WP Projects Portfolio with Client Testimonials
- Affected
- up to 3.0
- What to do
- Affects up to 3.0. Update WP Projects Portfolio with Client Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 4, 2025WP Projects Portfolio with Client Testimonials: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13114 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Projects Portfolio with Client Testimonials WordPress plugin through 3.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- WP Projects Portfolio with Client Testimonials
- Affected
- up to 3.0
- What to do
- Affects up to 3.0. Update WP Projects Portfolio with Client Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 30, 2025WE – Testimonial Slider: Stored Cross-Site ScriptingCVE-2024-13460 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WE – Testimonial Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Testimonial Author Names in all versions up to, and including, 1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- WE – Testimonial Slider
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update WE – Testimonial Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Jan 25, 2025Divi Carousel Maker – Image, Logo, Testimonial, Post Carousel & More: Stored Cross-Site ScriptingCVE-2025-0350 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Divi Carousel Maker – Image, Logo, Testimonial, Post Carousel & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Carousel and Logo Carousel in all versions up to, and including, 2.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Divi Carousel Maker – Image, Logo, Testimonial, Post Carousel & More
- Affected
- up to 2.0.4
- What to do
- Affects up to 2.0.4. Update Divi Carousel Maker – Image, Logo, Testimonial, Post Carousel & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 16, 2025Web Testimonials: Cross-Site Request Forgery (CSRF)CVE-2025-23560 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in plumwd Web Testimonials web-testimonials allows Stored XSS.This issue affects Web Testimonials: from n/a through <= 1.2.
- Product
- Web Testimonials
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Web Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 15, 2025Social proof testimonials and reviews by Repuso: Stored Cross-Site ScriptingCVE-2024-13351 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Social proof testimonials and reviews by Repuso plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'rw_image_badge1' shortcode in all versions up to, and including, 5.20 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Social proof testimonials and reviews by Repuso
- Affected
- up to 5.20
- What to do
- Affects up to 5.20. Update Social proof testimonials and reviews by Repuso to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 2, 2025Social proof testimonials and reviews by Repuso: Missing AuthorizationCVE-2023-46196 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Repuso Social proof testimonials and reviews by Repuso social-testimonials-and-reviews-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Social proof testimonials and reviews by Repuso: from n/a through <= 4.97.
- Product
- Social proof testimonials and reviews by Repuso
- Affected
- up to 4.97
- What to do
- Affects up to 4.97. Update Social proof testimonials and reviews by Repuso to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 5, 2024Free Responsive Testimonials, Social Proof Reviews, and Customer Reviews – Stars Testimonials: Local File InclusionCVE-2024-11429 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Free Responsive Testimonials, Social Proof Reviews, and Customer Reviews – Stars Testimonials plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.3 via the 'stars-testimonials-with-slider-and-masonry-grid' shortcode. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary PHP files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where PHP files can be uploaded and included.
- Product
- Free Responsive Testimonials, Social Proof Reviews, and Customer Reviews – Stars Testimonials
- Affected
- up to 3.3.3
- What to do
- Affects up to 3.3.3. Update Free Responsive Testimonials, Social Proof Reviews, and Customer Reviews – Stars Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 4, 2024B Testimonial – testimonial plugin for WP: Stored Cross-Site ScriptingCVE-2024-11880 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The B Testimonial – testimonial plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'b_testimonial' shortcode in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- B Testimonial – testimonial plugin for WP
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update B Testimonial – testimonial plugin for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 22, 2024Tribute Testimonials – WordPress Testimonial Grid/Slider: Stored Cross-Site ScriptingCVE-2024-10886 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Tribute Testimonials – WordPress Testimonial Grid/Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tribute_testimonials_slider' shortcode in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Tribute Testimonials – WordPress Testimonial Grid/Slider
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update Tribute Testimonials – WordPress Testimonial Grid/Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 19, 2024ESB Testimonials: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51936 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eSparkBiz ESB Testimonials esb-testimonials allows Stored XSS.This issue affects ESB Testimonials: from n/a through <= 1.0.0.
- Product
- ESB Testimonials
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update ESB Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 19, 2024Testimonial Slider Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51925 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sazzad Testimonial Slider Shortcode testimonial-slider-shortcode allows Stored XSS.This issue affects Testimonial Slider Shortcode: from n/a through <= 1.1.9.
- Product
- Testimonial Slider Shortcode
- Affected
- up to 1.1.9
- What to do
- Affects up to 1.1.9. Update Testimonial Slider Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 19, 2024Luzuk Testimonials: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51872 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in luzuk Themes Luzuk Testimonials luzuk-testimonials allows Stored XSS.This issue affects Luzuk Testimonials: from n/a through <= 0.0.1.
- Product
- Luzuk Testimonials
- Affected
- up to 0.0.1
- What to do
- Affects up to 0.0.1. Update Luzuk Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 19, 2024Faltu Testimonial Rotator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51853 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alberuni Azad. Faltu Testimonial Rotator faltu-testimonial-rotator allows DOM-Based XSS.This issue affects Faltu Testimonial Rotator: from n/a through <= 1.0.0.
- Product
- Faltu Testimonial Rotator
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Faltu Testimonial Rotator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 19, 2024Awesome Fitness Testimonials: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51806 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shingo Awesome Fitness Testimonials awesome-fitness-testimonials allows Stored XSS.This issue affects Awesome Fitness Testimonials: from n/a through <= 1.0.1.
- Product
- Awesome Fitness Testimonials
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Awesome Fitness Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 12, 2024Social Proof (Testimonial) Slider: Stored Cross-Site ScriptingCVE-2024-8985 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Social Proof (Testimonial) Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's spslider-block shortcode in all versions up to, and including, 2.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Social Proof (Testimonial) Slider
- Affected
- up to 2.2.4
- What to do
- Affects up to 2.2.4. Update Social Proof (Testimonial) Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 9, 2024Aajoda Testimonials: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51614 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aajoda Aajoda Testimonials aajoda-testimonials allows Stored XSS.This issue affects Aajoda Testimonials: from n/a through <= 2.2.2.
- Product
- Aajoda Testimonials
- Affected
- up to 2.2.2
- What to do
- Affects up to 2.2.2. Update Aajoda Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Strong Testimonials: Missing AuthorizationCVE-2024-47362 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials.This issue affects Strong Testimonials: from n/a through <= 3.1.16.
- Product
- Strong Testimonials
- Affected
- up to 3.1.16
- What to do
- Affects up to 3.1.16. Update Strong Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 17, 2024Simple Testimonials Showcase: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49295 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PressTigers Simple Testimonials Showcase simple-testimonials-showcase allows Stored XSS.This issue affects Simple Testimonials Showcase: from n/a through <= 1.1.6.
- Product
- Simple Testimonials Showcase
- Affected
- up to 1.1.6
- What to do
- Affects up to 1.1.6. Update Simple Testimonials Showcase to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2024Review & testimonial widgets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-44022 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Trustmary Review & testimonial widgets trustmary allows Stored XSS.This issue affects Review & testimonial widgets: from n/a through <= 1.0.5.
- Product
- Review & testimonial widgets
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Review & testimonial widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 1, 2024Free Responsive Testimonials, Social Proof Reviews, and Customer Reviews – Stars Testimonials: Stored Cross-Site ScriptingCVE-2024-8989 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Free Responsive Testimonials, Social Proof Reviews, and Customer Reviews – Stars Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's stars_testimonials shortcode in all versions up to, and including, 3.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Free Responsive Testimonials, Social Proof Reviews, and Customer Reviews – Stars Testimonials
- Affected
- up to 3.3.1
- What to do
- Affects up to 3.3.1. Update Free Responsive Testimonials, Social Proof Reviews, and Customer Reviews – Stars Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 26, 2024Super Testimonials: Stored Cross-Site ScriptingCVE-2024-9127 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Super Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘alignment’ parameter in all versions up to, and including, 3.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Super Testimonials
- Affected
- up to 3.0.0
- What to do
- Affects up to 3.0.0. Update Super Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 25, 2024Testimonials: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-43959 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Testimonials super-testimonial allows Reflected XSS.This issue affects Testimonials: from n/a through <= 4.0.1.
- Product
- Testimonials
- Affected
- up to 4.0.1
- What to do
- Affects up to 4.0.1. Update Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 27, 2024Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More: Cross-Site Request ForgeryCVE-2024-8200 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.2. This is due to missing or incorrect nonce validation on the 'update_api_key' function. This makes it possible for unauthenticated attackers to update an API key via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 27, 2024Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More: Unauthorized modification of dataCVE-2024-8199 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_api_key' function in all versions up to, and including, 1.1.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update API Key options.
- Product
- Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 26, 2024WP Testimonial Widget: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43967 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Stark Digital WP Testimonial Widget allows Stored XSS.This issue affects WP Testimonial Widget: from n/a through 3.1.
- Product
- WP Testimonial Widget
- Affected
- up to 3.1
- What to do
- Affects up to 3.1. Update WP Testimonial Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 26, 2024WP Testimonial Widget: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-43966 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Stark Digital WP Testimonial Widget.This issue affects WP Testimonial Widget: from n/a through 3.1.
- Product
- WP Testimonial Widget
- Affected
- up to 3.1
- What to do
- Affects up to 3.1. Update WP Testimonial Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.