Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

14 records

Vendor: ghuger Clear all filters
TI-2024-08165 CVE-2024-8799 · GHSA-8xgh-92p8-484p

Custom Banners <= 3.3 - Reflected Cross-Site Scripting

Priority LOW 27

The Custom Banners plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.3.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00348 Published 2024-10-01 No fix listed CWE-79
TI-2024-02172 CVE-2024-2337 · GHSA-7cpj-f7p2-p5cr

Easy Testimonials <= 3.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Priority LOW 28

The Easy Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'testimonials_grid ' shortcode in all versions up to, and including, 3.9.5 due to insufficient input sanitization a…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00355 Published 2024-07-20 No fix listed CWE-79
TI-2021-03264 CVE-2021-4407 · GHSA-xqgm-mm4x-rx9j

Custom Banners <= 3.2.2 - Cross-Site Request Forgery Bypass

Priority LOW 20

The Custom Banners plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2.2 This is due to missing or incorrect nonce validation on the saveCustomFields() function.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00384 Published 2023-07-12 No fix listed CWE-352
TI-2020-18918 CVE-2020-36749 · GHSA-7vj6-p5mc-mm84

Easy Testimonials <= 3.6.1 - Cross-Site Request Forgery Bypass

Priority LOW 20

The Easy Testimonials plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.6.1.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00464 Published 2023-07-01 Fixed in 3.7 CWE-352
TI-2021-03251 CVE-2021-4394 · GHSA-gp2m-p45c-8rv4

Locations <= 3.2.1 - Cross-Site Request Forgery Bypass

Priority MEDIUM 55

The Locations plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2.1.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00464 Published 2023-07-01 No fix listed CWE-352
TI-2022-04181 CVE-2022-4577 · GHSA-cwj4-5mgc-phhv

Easy Testimonials < 3.9.3 - Contributor+ Stored XSS

Priority MEDIUM 58

The Easy Testimonials WordPress plugin before 3.9.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perf…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00649 Published 2023-02-06 Fixed in 3.9.3 CWE-79
TI-2020-11764 CVE-2020-14959 · GHSA-r4mv-4fr7-mf48

Multiple XSS vulnerabilities in the Easy Testimonials plugin before 3.6 for WordPress…

Priority LOW 26

Multiple XSS vulnerabilities in the Easy Testimonials plugin before 3.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the wp-admin/post.php Client Name, Position, Web Address, Other, Loc…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00892 Published 2020-06-21 No fix listed CWE-79
TI-2017-08924 CVE-2017-12131 · GHSA-mg94-4qw6-gcgj

The Easy Testimonials plugin 3.0.4 for WordPress has XSS in…

Priority LOW 29

The Easy Testimonials plugin 3.0.4 for WordPress has XSS in include/settings/display.options.php, as demonstrated by the Default Testimonials Width, View More Testimonials Link, and Testimonial Excerpt Options screens.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.0078 Published 2017-08-01 No fix listed CWE-79