The hndtst_action_instance_callback AJAX call of the Handsome Testimonials & Reviews WordPress plugin before 2.1.1, available to any authenticated users, does not sanitise, validate or escape the hndtst_previewShortcodeI…
CVSS 3.1HIGH 8.8·Network·Low privileges·No interaction·EPSS 0.01599·Published 2021-08-02·Fixed in 2.1.1CWE-89