Testimonials (Free < 2.7, Pro < 1.0.8) – Admin+ Stored Cross-Site Scripting | CVE 2022-3539 | Plugin Vulnerabilities

Description

The plugins do not sanitize and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

Proof of Concept

Create new Testimonial, add the following payload to either Position or Testimonial Text field: "></textarea><img src onerror=alert(/XSS/)>

Publish it, the payload will be triggered in the backend (in the Testimonial list, and when editing the related testimonial), and in page/posts where the shortcode is embed

Affects Plugins

super-testimonial

Fixed in 2.7

super-testimonial-pro

Fixed in 1.0.8

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Asif Nawaz Minhas

Submitter

Asif Nawaz Minhas

Submitter website

https://www.hackpertise.com/

Verified

Yes

WPVDB ID

ab3b0052-1a74-4ba3-b6d2-78cfe56029db

Timeline

Publicly Published

2022-10-20 (about 3 years ago)

Added

2022-10-20 (about 3 years ago)

Last Updated

2022-10-20 (about 3 years ago)

Other

Published

Title

Published

2025-01-17

Title

Tantyyellow <= 1.0.0.5 - Reflected Cross-Site Scripting

Published

2024-10-15

Title

Appointment Booking Calendar < 1.6.7.55 - Admin+ Stored XSS

Published

2024-04-04

Title

Passster < 4.2.6.5 - Contributor+ Stored XSS via content_protector Shortcode

Published

2025-04-09

Title

Twispay Credit Card Payments <= 2.1.2 - Reflected Cross-Site Scripting

Published

2015-01-13

Title

Custom Sidebars 2.1.0.1 - XSS