WordPress Plugin Vulnerabilities

Testimonial Slider < 1.3.2 - Stored XSS via CSRF

Description

The plugin does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack

Affects Plugins

Plugin icon
testimonial-slider
Fixed in 1.3.2

References

CVE
CVE-2022-44741

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
6.1 (medium)

Miscellaneous

Original Researcher
ptsfence
Verified
No
WPVDB ID
c09e67bb-20ee-4579-82a8-2d3fc46e7ca7

Timeline

Publicly Published
2022-11-07 (about 1 years ago)
Added
2022-11-08 (about 1 years ago)
Last Updated
2023-08-07 (about 9 months ago)

Other

Published
Title
Published
2021-09-15
Title
SEO Redirection < 7.9 - Arbitrary Redirect Deletion via CSRF
Published
2022-05-06
Title
PNG to JPG < 4.1 - Stored Cross-Site Scripting via CSRF
Published
2021-04-16
Title
Edwiser Bridge < 2.0.7 - CSRF Nonce Bypass
Published
2020-06-16
Title
Delete All Comments Easily <= 1.3 - All Comments Deletion via CSRF
Published
2020-09-16
Title
Multiple Plugins/Themes - Cross-Site Request Forgery (CSRF)