CVE-2021-24598

Testimonial Builder < 1.6.0 - Admin+ Stored Cross-Site Scripting

EPSS 0.7%CWE-79

Vexday Risk Score

3Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS —EPSS 0.7%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

17 Nov 2021Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

The Testimonial WordPress plugin before 1.6.0 does not escape some testimonial fields which could allow high privilege users to perform Cross Site Scripting attacks even when the unfiltered_html capability is disallowed

Affected products

Unknown · Testimonial

References

https://plugins.trac.wordpress.org/changeset/2606523/https://wpscan.com/vulnerability/365c09a7-0b10-4145-a415-5c0e9f429ae0