Cross-Site Scripting Vulnerabilities in HMS Testimonials Plugin for WordPress
CVE-2013-4241

6.1MEDIUM

Key Information:

Vendor

Wordpress
Status
Hms Testimonials
Vendor
CVE Published:
30 January 2020

What is CVE-2013-4241?

Multiple cross-site scripting (XSS) vulnerabilities exist in the HMS Testimonials plugin for WordPress prior to version 2.0.11. These vulnerabilities allow remote attackers to inject malicious web scripts or HTML into the application by exploiting various parameters, including name, image, URL, and testimonial from the submission form, as well as parameters in settings related to date format and custom fields. This can lead to unauthorized access to user sessions or the execution of malicious scripts in the context of users visiting affected pages.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

HMS Testimonials before 2.0.11

References

http://seclists.org/fulldisclosure/2013/Aug/96
x_refsource_MISC
http://seclists.org/fulldisclosure/2013/Aug/98
x_refsource_MISC
http://seclists.org/oss-sec/2013/q3/345
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.