Cross-Site Scripting Vulnerabilities in HMS Testimonials Plugin for WordPress
CVE-2013-4241

6.1MEDIUM

Key Information:

Vendor
Wordpress
Status
Hms Testimonials
Vendor
CVE Published:
30 January 2020

Summary

Multiple cross-site scripting (XSS) vulnerabilities exist in the HMS Testimonials plugin for WordPress prior to version 2.0.11. These vulnerabilities allow remote attackers to inject malicious web scripts or HTML into the application by exploiting various parameters, including name, image, URL, and testimonial from the submission form, as well as parameters in settings related to date format and custom fields. This can lead to unauthorized access to user sessions or the execution of malicious scripts in the context of users visiting affected pages.

Affected Version(s)

HMS Testimonials before 2.0.11

References

http://seclists.org/fulldisclosure/2013/Aug/96
x_refsource_MISC
http://seclists.org/fulldisclosure/2013/Aug/98
x_refsource_MISC
http://seclists.org/oss-sec/2013/q3/345
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.