WordPress Plugin Vulnerabilities

Easy Testimonials < 3.9 - Reflected Cross-Site Scripting

Description

The plugin, when used along the Pro version, does not escape an URL before outputting it back in an attribute, leading to Reflected Cross-Site Scripting

Proof of Concept

Affects Plugins

Plugin icon
easy-testimonials
Fixed in 3.9

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
4.7 (medium)

Miscellaneous

Original Researcher
WPScanTeam
Verified
Yes
WPVDB ID
571fc466-98c5-4f11-9ac3-0f826f3d9253

Timeline

Publicly Published
2022-06-14 (about 3 years ago)
Added
2022-06-14 (about 3 years ago)
Last Updated
2022-06-14 (about 3 years ago)

Other

Published
Title
Published
2024-02-28
Title
System Dashboard < 2.8.10 - XSS via Header Injection
Published
2025-05-07
Title
Robo Gallery < 5.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published
2021-06-28
Title
Tutor LMS < 1.9.2 - Authenticated Stored Cross-Site Scripting (XSS)
Published
2021-12-08
Title
Fathom Analytics < 3.0.5 - Admin+ Stored Cross-Site Scripting
Published
2021-12-27
Title
WP User Frontend < 3.5.26 - SQL Injection to Reflected Cross-Site Scripting