Critical security advisoryCriticalFlagged by our vulnerability database: PHP2Shell is on CISA’s exploited list. Most WordPress hosting runs PHP. See if your site is affectedFlagged by our vulnerability database: PHP2Shell is being exploited. DetailsExploited: PHP2Shell. Check your site
HuttenlocherTechnologies
843-331-6339
Start a project →
Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list
37added in the last 30 days
544new WordPress flaws this week
391,181entries in the database

162 results · page 4 of 4

  • Jun 21, 2020Multiple XSS vulnerabilities in the Easy Testimonials plugin before 3.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the wp-aCVE-2020-14959 · WordPress plugins & themes · reported by MITREMedium 5.4

    Multiple XSS vulnerabilities in the Easy Testimonials plugin before 3.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the wp-admin/post.php Client Name, Position, Web Address, Other, Location Reviewed, Product Reviewed, Item Reviewed, or Rating parameter.

    Product
    Multiple XSS vulnerabilities in the Easy Testimonials
    Fixed in
    3.6
    What to do
    Update Multiple XSS vulnerabilities in the Easy Testimonials to 3.6 or newer.

    Full record and what to do →NVD recordwpvulndb.comwpvulndb.com

  • Feb 3, 2020Stored XSS in the Strong Testimonials plugin before 2.40.1 for WordPress can result in an attacker performing malicious actions such as stealing session tokens.CVE-2020-8549 · WordPress plugins & themes · reported by MITREMedium 6.1

    Stored XSS in the Strong Testimonials plugin before 2.40.1 for WordPress can result in an attacker performing malicious actions such as stealing session tokens.

    Product
    Stored XSS in the Strong Testimonials
    Fixed in
    2.40.1
    What to do
    Update Stored XSS in the Strong Testimonials to 2.40.1 or newer.

    Full record and what to do →NVD recordpacketstormsecurity.comgithub.com

  • Jan 30, 2020Multiple cross-site scripting (XSS) vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress allow remote attackers to inject arbitrary web scCVE-2013-4241 · WordPress plugins & themes · reported by Red HatMedium 6.1

    Multiple cross-site scripting (XSS) vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) image, (3) url, or (4) testimonial parameter to the Testimonial form (hms-testimonials-addnew page); (5) date_format parameter to the Settings - Default form (hms-testimonials-settings page); (6) name parameter in a Save action to the Settings - Custom Fields form (hms-testimonials-settings-fields page); or (7) name parameter in a Save action to the Settings - Template form (hms-testimonials-templates-new page).

    Product
    Multiple cross-site scripting (XSS) vulnerabilities in the HMS Testimonials
    Fixed in
    2.0.11
    What to do
    Update Multiple cross-site scripting (XSS) vulnerabilities in the HMS Testimonials to 2.0.11 or newer.

    Full record and what to do →NVD recordseclists.orgseclists.org

  • Sep 25, 2019The testimonial-slider plugin through 1.2.1 for WordPress has CSRF with resultant XSS.CVE-2015-9417 · WordPress plugins & themes · reported by MITREMedium 6.5

    The testimonial-slider plugin through 1.2.1 for WordPress has CSRF with resultant XSS.

    Product
    testimonial-slider
    Affected
    up to 1.2.1
    What to do
    Affects up to 1.2.1. Update testimonial-slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordwordpress.orgwpvulndb.com

  • Aug 21, 2019The bws-testimonials plugin before 0.1.9 for WordPress has multiple XSS issues.CVE-2017-18558 · WordPress plugins & themes · reported by MITREMedium 6.1

    The bws-testimonials plugin before 0.1.9 for WordPress has multiple XSS issues.

    Product
    bws-testimonials
    Fixed in
    0.1.9
    What to do
    Update bws-testimonials to 0.1.9 or newer.

    Full record and what to do →NVD recordwordpress.orgwordpress.org

  • Nov 26, 2018Stored XSS was discovered in the Easy Testimonials plugin 3.2 for WordPress.CVE-2018-19564 · WordPress plugins & themes · reported by MITREMedium 6.1

    Stored XSS was discovered in the Easy Testimonials plugin 3.2 for WordPress. Three wp-admin/post.php parameters (_ikcf_client and _ikcf_position and _ikcf_other) have Cross-Site Scripting.

    Product
    Easy Testimonials
    Affected
    3.2 to 3.2
    What to do
    Affects 3.2 to 3.2. Update Easy Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordexploit-db.comexploit-db.com

  • Jan 12, 2018The Testimonial Slider plugin through 1.2.4 for WordPress has SQL Injection via settings\sliders.php (current_slider_id parameter).CVE-2018-5372 · WordPress plugins & themes · reported by MITREHigh 8.8

    The Testimonial Slider plugin through 1.2.4 for WordPress has SQL Injection via settings\sliders.php (current_slider_id parameter).

    Product
    Testimonial Slider
    Affected
    up to 1.2.4
    What to do
    Affects up to 1.2.4. Update Testimonial Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recorddefensecode.comdefensecode.com

  • Aug 1, 2017The Easy Testimonials plugin 3.0.4 for WordPress has XSS in include/settings/display.options.php, as demonstrated by the Default Testimonials Width, View More TCVE-2017-12131 · WordPress plugins & themes · reported by MITREMedium 6.1

    The Easy Testimonials plugin 3.0.4 for WordPress has XSS in include/settings/display.options.php, as demonstrated by the Default Testimonials Width, View More Testimonials Link, and Testimonial Excerpt Options screens.

    Affected
    3.0.4 to 3.0.4
    What to do
    Affects 3.0.4 to 3.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordgithub.comgithub.com

  • Jun 12, 2017SQL injection vulnerability in the WP-Testimonials plugin 3.4.1 for WordPress allows an authenticated user to execute arbitrary SQL commands via the testid paraCVE-2017-9418 · WordPress plugins & themes · reported by MITREHigh 8.8

    SQL injection vulnerability in the WP-Testimonials plugin 3.4.1 for WordPress allows an authenticated user to execute arbitrary SQL commands via the testid parameter to wp-admin/admin.php.

    Product
    WP-Testimonials
    Affected
    3.4.1 to 3.4.1
    What to do
    Affects 3.4.1 to 3.4.1. Update WP-Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordwpvulndb.comexploit-db.com

  • Apr 2, 2014Multiple cross-site request forgery (CSRF) vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress allow remote attackers to hijack the autheCVE-2013-4240 · WordPress plugins & themes · reported by Red HatMedium 6.8

    Multiple cross-site request forgery (CSRF) vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) add new testimonials via the hms-testimonials-addnew page, (2) add new groups via the hms-testimonials-addnewgroup page, (3) change default settings via the hms-testimonials-settings page, (4) change advanced settings via the hms-testimonials-settings-advanced page, (5) change custom fields settings via the hms-testimonials-settings-fields page, or (6) change template settings via the hms-testimonials-templates-new page to wp-admin/admin.php.

    Product
    Multiple cross-site request forgery (CSRF) vulnerabilities in the HMS Testimonials
    Fixed in
    2.0.11
    What to do
    Update Multiple cross-site request forgery (CSRF) vulnerabilities in the HMS Testimonials to 2.0.11 or newer.

    Full record and what to do →NVD recordosvdb.orgseclists.org

  • Sep 10, 2013SQL injection vulnerability in testimonial.php in the IndiaNIC Testimonial plugin 2.2 for WordPress allows remote attackers to execute arbitrary SQL commands viCVE-2013-5673 · WordPress plugins & themes · reported by MITREHigh 7.5

    SQL injection vulnerability in testimonial.php in the IndiaNIC Testimonial plugin 2.2 for WordPress allows remote attackers to execute arbitrary SQL commands via the custom_query parameter in a testimonial_add action to wp-admin/admin-ajax.php.

    Product
    IndiaNIC Testimonial
    What to do
    Update IndiaNIC Testimonial to the newest version.

    Full record and what to do →NVD recordarchives.neohapsis.comosvdb.org

  • Sep 10, 2013Multiple cross-site request forgery (CSRF) vulnerabilities in the IndiaNIC Testimonial plugin 2.2 for WordPress allow remote attackers to hijack the authenticatCVE-2013-5672 · WordPress plugins & themes · reported by MITREMedium 6.8

    Multiple cross-site request forgery (CSRF) vulnerabilities in the IndiaNIC Testimonial plugin 2.2 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) add a testimonial via an iNIC_testimonial_save action; (2) add a listing template via an iNIC_testimonial_save_listing_template action; (3) add a widget template via an iNIC_testimonial_save_widget action; insert cross-site scripting (XSS) sequences via the (4) project_name, (5) project_url, (6) client_name, (7) client_city, (8) client_state, (9) description, (10) tags, (11) video_url, or (12) is_featured, (13) title, (14) widget_title, (15) no_of_testimonials, (16) filter_by_country, (17) filter_by_tags, or (18) widget_template parameter to wp-admin/admin-ajax.php.

    Product
    IndiaNIC Testimonial
    What to do
    Update IndiaNIC Testimonial to the newest version.

    Full record and what to do →NVD recordarchives.neohapsis.comosvdb.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Get in touch

Tell us what you're building.

A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.

01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
843-331-6339

Not ready to talk yet? Run the free website check and see what Google sees.

What do you need?
Build
Grow
Protect
Urgent

No newsletter, no sales sequence. Just a reply.