CVE-2021-24156— Testimonial Rotator <= 3.0.3 - Authenticated Stored Cross-Site Scripting
Quick assessment
Affected
Unknown Testimonial Rotator
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Testimonial Rotator是个人开发者的一个 wordpress 插件。该插件用于管理站点的推荐信信息。 Testimonial Rotator 3.0.3 存在跨站脚本漏洞，该漏洞允许低特权用户(贡献者)在未经批准的情况下注入任意JavaScript代码或HTML。
Possible ATT&CK Techniques 2 AI
T1068 · Exploitation for Privilege Escalation T1059.007 · JavaScript
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2021-24156
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Testimonial Rotator <= 3.0.3 - Authenticated Stored Cross-Site Scripting
Source: CVE Program / CVE List V5
Vulnerability Description
Stored Cross-Site Scripting vulnerabilities in Testimonial Rotator 3.0.3 allow low privileged users (Contributor) to inject arbitrary JavaScript code or HTML without approval. This could lead to privilege escalation
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
Testimonial Rotator 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Testimonial Rotator是个人开发者的一个 wordpress 插件。该插件用于管理站点的推荐信信息。 Testimonial Rotator 3.0.3 存在跨站脚本漏洞，该漏洞允许低特权用户(贡献者)在未经批准的情况下注入任意JavaScript代码或HTML。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Testimonial Rotator | 3.0.3 ~ 3.0.3 | - |
|
II. Public POCs for CVE-2021-24156
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-24156
请登录查看更多情报信息。
Vendor Advisories for CVE-2021-24156 (1)
-
https://wpscan.com/vulnerability/8b6f4a77-4008-4730-9a91-fa055a8b3e68 x_refsource_CONFIRM
Other References for CVE-2021-24156 (1)
Same Patch Batch · Unknown · 2021-04-05 · 45 CVEs total
| CVE-2021-24163 | Ninja Forms < 3.4.34 - Authenticated SendWP Plugin Installation and Client Secret Key Disc | |
| CVE-2021-24166 | Ninja Forms < 3.4.34 - CSRF to OAuth Service Disconnection | |
| CVE-2021-24165 | Ninja Forms < 3.4.34 - Administrator Open Redirect | |
| CVE-2021-24167 | Web-Stat < 1.4.1 - API Key Disclosure | |
| CVE-2021-24153 | Yoast SEO < 3.4.1 - Authenticated Stored Cross-Site Scripting (XSS) | |
| CVE-2021-24154 | Theme Editor < 2.6 - Authenticated Arbitrary File Download | |
| CVE-2021-24155 | Backup Guard < 1.6.0 - Authenticated Arbitrary File Upload | |
| CVE-2021-24157 | Orbit Fox by ThemeIsle < 2.10.3 - Authenticated Stored Cross Site Scripting | |
| CVE-2021-24158 | Orbit Fox by ThemeIsle < 2.10.3 - Authenticated Privilege Escalation | |
| CVE-2021-24152 | Popup Builder < 3.74 - Authenticated Reflected Cross-Site Scripting (XSS) | |
| CVE-2021-24164 | Ninja Forms < 3.4.34.1 - Authenticated OAuth Connection Key Disclosure | |
| CVE-2021-24159 | Contact Form 7 Style <= 3.1.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting | |
| CVE-2021-24176 | JH 404 Logger <= 1.1 - Unauthenticated Stored Cross-Site Scripting (XSS) | |
| CVE-2021-24175 | The Plus Addons for Elementor Page Builder < 4.1.7 - Authentication Bypass | |
| CVE-2021-24174 | Database Backups <= 1.2.2.6 - CSRF to Backup Download | |
| CVE-2021-24173 | VM Backups <= 1.0 - CSRF to Stored Cross-Site Scripting (XSS) | |
| CVE-2021-24172 | VM Backups <= 1.0 - CSRF to Database Backup Download | |
| CVE-2021-24171 | WooCommerce Upload Files < 59.4 - Unauthenticated Arbitrary File Upload | |
| CVE-2021-24170 | User Profile Picture < 2.5.0 - Sensitive Information Disclosure | |
| CVE-2021-24169 | Advanced Order Export For WooCommerce < 3.1.8 - Reflected Cross-Site Scripting (XSS) |
Showing top 20 of 45 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same vendor: Unknown
-
CVE-2026-96173
Payments for Hubtel < 1.0.2 - Unauthenticated Order Key Disc -
CVE-2026-96200
Payments for Hubtel < 1.0.2 - Unauthenticated Payment Confir -
CVE-2026-96255
Payments for Hubtel < 1.0.2 - Unauthenticated Payment Gatewa -
CVE-2026-89296
Pro Like Button < 2.0 - Unauthenticated SQLi via 'postid' Pa -
CVE-2026-87973
If-So Dynamic Content 1.9.9 - 1.10.1 - Editor+ Stored XSS vi
Same weakness: CWE-79
-
CVE-2026-56589
HCL BigFix Service Management is affected by multiple securi -
CVE-2026-102378
WordPress Parallax Section block plugin <= 2.0.4 - Cross Sit -
CVE-2026-97273
WordPress Premmerce Wishlist for WooCommerce plugin <= 1.1.1 -
CVE-2026-97268
WordPress Premmerce Wishlist for WooCommerce plugin <= 1.1.1 -
CVE-2026-97260
WordPress MaxGalleria plugin <= 6.5.3 - Cross Site Scripting
V. Comments for CVE-2021-24156
No comments yet