Medium severity · published Jan 30, 2020
CVE-2013-4241
Multiple cross-site scripting (XSS) vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress allow remote attackers to inject arbitrary web script or HTML via…
6.1
CVSS
3.7%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) image, (3) url, or (4) testimonial parameter to the Testimonial form (hms-testimonials-addnew page); (5) date_format parameter to the Settings - Default form (hms-testimonials-settings page); (6) name parameter in a Save action to the Settings - Custom Fields form (hms-testimonials-settings-fields page); or (7) name parameter in a Save action to the Settings - Template form (hms-testimonials-templates-new page).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)3.7% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HT
Hms Testimonials · Hitmyserver
before 2.0.11 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-4241
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-4241
Exploit
http://seclists.org/fulldisclosure/2013/Aug/96
Exploit
http://seclists.org/fulldisclosure/2013/Aug/98
Mailing List
http://seclists.org/oss-sec/2013/q3/345
Mailing List
http://seclists.org/oss-sec/2013/q3/361
Release Notes
https://wordpress.org/plugins/hms-testimonials/#developers
More from Hms Testimonials
–
CVE-2013-4240
Multiple cross-site request forgery (CSRF) vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress allow remote attackers to hijack the authentication of…