Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

3 records

Vendor: Axelerant Component: Testimonials Widget Clear all filters
TI-2024-25053 CVE-2024-37553 · GHSA-463j-vg48-vjm8

WordPress Testimonials Widget plugin <= 4.0.4 - Cross Site Scripting (XSS) vulnerability

Priority LOW 29

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Axelerant Testimonials Widget allows Stored XSS.This issue affects Testimonials Widget: from n/a through 4.0.4.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00277 Published 2024-07-06 No fix listed CWE-79
TI-2024-04378 CVE-2024-4705 · GHSA-r4gp-r2fv-c7gg

Testimonials Widget <= 4.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via testimonials Shortcode

Priority LOW 28

The Testimonials Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's testimonials shortcode in all versions up to, and including, 4.0.4 due to insufficient input sanitization and out…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00279 Published 2024-06-06 No fix listed CWE-79
TI-2021-06428 CVE-2021-24136 · GHSA-r79g-qpgg-cqg5

Testimonials Widget < 4.0.0 - Multiple Authenticated Stored XSS

Priority LOW 26

Unvalidated input and lack of output encoding in the Testimonials Widget WordPress plugin, versions before 4.0.0, lead to multiple Cross-Site Scripting vulnerabilities, allowing remote attackers to inject arbitrary JavaS…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00822 Published 2021-03-18 Fixed in 4.0.0 CWE-79