CVE-2021-24598

Testimonial Builder < 1.6.0 - Admin+ Stored Cross-Site Scripting

EPSS 0.7%CWE-79

Vexday Risk Score

3Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS —EPSS 0.7%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

17 nov 2021Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

The Testimonial WordPress plugin before 1.6.0 does not escape some testimonial fields which could allow high privilege users to perform Cross Site Scripting attacks even when the unfiltered_html capability is disallowed

Productos afectados

Unknown · Testimonial

Referencias

https://plugins.trac.wordpress.org/changeset/2606523/https://wpscan.com/vulnerability/365c09a7-0b10-4145-a415-5c0e9f429ae0