Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Testimonial WordPress Plugin – AP Custom Testimonial 1.4.6*, 1.4.7 Clear all filters
TI-2022-07891 CVE-2022-23912 · GHSA-cj7m-j9f8-r77c

AP Custom Testimonial < 1.4.8 - Reflected Cross-Site Scripting

Priority LOW 29

The Testimonial WordPress Plugin WordPress plugin before 1.4.7 does not sanitise and escape the id parameter before outputting it back in an attribute, leading to a Reflected cross-Site Scripting

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00866 Published 2022-02-28 Fixed in 1.4.7 CWE-79
TI-2022-07890 CVE-2022-23911 · GHSA-fcvq-9h68-fmx6

AP Custom Testimonial < 1.4.8 - Admin+ SQL Injection

Priority LOW 35

The Testimonial WordPress Plugin WordPress plugin before 1.4.7 does not validate and escape the id parameter before using it in a SQL statement when retrieving a testimonial to edit, leading to a SQL Injection

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01467 Published 2022-02-28 Fixed in 1.4.7 CWE-89