CVE-2021-36858: WordPress Testimonials plugin <= 2.6 - Auth. Stored Cross-Site Scripting (XSS) vulnerability - Patchstack

Verified

Fixed

4.8

CVSS 3.1 score Medium severity

Report

Monitoring Not reported to be exploited

Vulnerable versions

<= 2.6

PSID

fb3b0a682048

Classification

Cross Site Scripting (XSS)

OWASP Top 10

A7: Cross-Site Scripting (XSS)

Required privilege

Requires high role user authentication like admin.

Publicly disclosed

2022-10-27

Details

Auth. Stored Cross-Site Scripting (XSS) vulnerability discovered by Ngo Van Thien (Patchstack Alliance) in WordPress Testimonials plugin (versions <= 2.6).

Solution

Update the WordPress Testimonials plugin to the latest available version (at least 2.7).

References