CVE-2021-24598

Testimonial Builder < 1.6.0 - Admin+ Stored Cross-Site Scripting

EPSS 0.7%CWE-79

Vexday Risk Score

3Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS —EPSS 0.7%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

17 nov 2021Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

The Testimonial WordPress plugin before 1.6.0 does not escape some testimonial fields which could allow high privilege users to perform Cross Site Scripting attacks even when the unfiltered_html capability is disallowed

Produtos afetados

Unknown · Testimonial

Referências

https://plugins.trac.wordpress.org/changeset/2606523/https://wpscan.com/vulnerability/365c09a7-0b10-4145-a415-5c0e9f429ae0