WordPress Plugin Vulnerabilities

Testimonial Slider < 3.5.8.5 - Contributor+ Stored Cross-Site Scripting

Description

The plugin does not sanitise and escape some of its slider settings, such as mpsp_posts_bg_color, mpsp_posts_description_color, mpsp_slide_nav_button_color which could allow users with the edit_post capability (contributor and above) to perform Cross-Site Scripting attacks

Affects Plugins

Plugin icon
testimonial-add
Fixed in 3.5.8.5

References

CVE
CVE-2021-36851

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Ngo Van Thien
Verified
Yes
WPVDB ID
515dd091-f8ec-467b-998f-2583665c7c55

Timeline

Publicly Published
2022-04-04 (about 4 years ago)
Added
2022-04-04 (about 4 years ago)
Last Updated
2022-11-08 (about 3 years ago)

Other

Published
Title
Published
2023-09-05
Title
Auto Amazon Links < 5.3.2 - Contributor+ Stored XSS
Published
2023-05-03
Title
OSM – OpenStreetMap < 6.0.6 - Contributor+ Stored XSS via Shortcode
Published
2025-07-08
Title
Simple Featured Image <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via slideshow Parameter
Published
2024-10-24
Title
Time Slot < 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2023-10-29
Title
Related Products for WooCommerce < 3.3.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode