WordPress Stars Testimonials Stored XSS Vulnerability (Authenticated)

From this webpage screenshot, the following key vulnerability information can be obtained: 1. Vulnerability Name: - Stars Testimonials <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via stars_testimonials Shortcode 2. Vulnerability Description: - The Free Responsive Testimonials, Social Proof Reviews, and Customer Reviews - Stars Testimonials plugin contains a Cross-Site Scripting (XSS) vulnerability in all versions up to and including 3.3.1, due to improper handling of user input and failure to properly escape user-provided attributes during output. - This allows users with Contributor or higher privileges to inject arbitrary scripts via the shortcode, which will execute when users visit the affected page. 3. Vulnerability Type: - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') 4. Vulnerability Rating: - CVSS: 3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - CVSS: 6.4 (Medium) 5. Disclosure Date: - September 30, 2024 6. Update Date: - October 1, 2024 7. Researcher: - Peter Thaleikis 8. Fix Status: - Yes (Fixed) 9. Affected Versions: - <= 3.3.1 10. Fixed Version: - 3.3.2 11. References: - plugins.trac.wordpress.org - wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org 12. Exploitation Mitigation: - Update to version 3.3.2, or a newer patched version 13. Impact: - Free Responsive Testimonials, Social Proof Reviews, and Customer Reviews - Stars Testimonials plugin 14. Vulnerability Type: - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') 15. Vulnerability Rating: - CVSS: 3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - CVSS: 6.4 (Medium) 16. Disclosure Date: - September 30, 2024 17. Update Date: - October 1, 2024 18. Researcher: - Peter Thaleikis 19. Fix Status: - Yes (Fixed) 20. Affected Versions: - <= 3.3.1 21. Fixed Version: - 3.3.2 22. References: - plugins.trac.wordpress.org - wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org 23. Exploitation Mitigation: - Update to version 3.3.2, or a newer patched version 24. Impact: - Free Responsive Testimonials, Social Proof Reviews, and Customer Reviews - Stars Testimonials plugin 25. Vulnerability Type: - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') 26. Vulnerability Rating: - CVSS: 3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - CVSS: 6.4 (Medium) 27. Disclosure Date: - September 30, 2024 28. Update Date: - October 1, 2024 29. Researcher: - Peter Thaleikis 30. Fix Status: - Yes (Fixed) 31. Affected Versions: - <= 3.3.1 32. Fixed Version: - 3.3.2 33. References: - plugins.trac.wordpress.org - wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org 34. Exploitation Mitigation: - Update to version 3.3.2, or a newer patched version 35. Impact: - Free Responsive Testimonials, Social Proof Reviews, and Customer Reviews - Stars Testimonials plugin 36. Vulnerability Type: - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') 37. Vulnerability Rating: - CVSS: 3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - CVSS: 6.4 (Medium) 38. Disclosure Date: - September 30, 2024 39. Update Date: - October 1, 2024 40. Researcher: - Peter Thaleikis 41. Fix Status: - Yes (Fixed) 42. Affected Versions: - <= 3.3.1 43. Fixed Version: - 3.3.2 44. References: - plugins.trac.wordpress.org - wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org 45. Exploitation Mitigation: - Update to version 3.3.2, or a newer patched version 46. Impact: - Free Responsive Testimonials, Social Proof Reviews, and Customer Reviews - Stars Testimonials plugin 47. Vulnerability Type: - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') 48. Vulnerability Rating: - CVSS: 3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - CVSS: 6.4 (Medium) 49. Disclosure Date: - September 30, 2024 50. Update Date: - October 1, 2024 51. Researcher: - Peter Thaleikis 52. Fix Status: - Yes (Fixed) 53. Affected Versions: - <= 3.3.1 54. Fixed Version: - 3.3.2 55. References: - plugins.trac.wordpress.org - wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org 56. Exploitation Mitigation: - Update to version 3.3.2, or a newer patched version 57. Impact: - Free Responsive Testimonials, Social Proof Reviews, and Customer Reviews - Stars Testimonials plugin 58. Vulnerability Type: - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') 59. Vulnerability Rating: - CVSS: 3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - CVSS: 6.4 (Medium) 60. Disclosure Date: - September 30, 2024 61. Update Date: - October 1, 2024 62. Researcher: - Peter Thaleikis 63. Fix Status: - Yes (Fixed) 64. Affected Versions: - <= 3.3.1 65. Fixed Version: - 3.3.2 66. References: - plugins.trac.wordpress.org - wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org 67. Exploitation Mitigation: - Update to version 3.3.2, or a newer patched version 68. Impact: - Free Responsive Test

Goal Reached Thanks to every supporter — we hit 100%!

WordPress Stars Testimonials Stored XSS Vulnerability (Authenticated)

More from this source