Strong Testimonials

A low-privilege authenticated attacker can reach protected functionality without the required authorization. The protected resource and exact operation are not disclosed. The endpoint, action and parameter are not disclosed. The CNA vector records limited integrity impact. Affected versions: at most 3.3.14.

An unauthenticated attacker can store script-bearing input that is later rendered without sufficient output escaping. A victim must view or otherwise interact with the affected content for script execution in the site origin. The export does not identify the exact attacker or victim WordPress roles. The endpoint, action and parameter are not disclosed. The CNA vector records limited confidentiality impact, limited integrity impact, limited availability impact. Affected versions: at most 3.3.12.

Strong Testimonials is a WordPress plugin affected through 3.3.12. The CNA vector requires low-privileged authenticated access, but no exact WordPress role is disclosed. In this vulnerability, untrusted serialized input reaches object deserialization; the CNA rates confidentiality, integrity and availability impacts high, but the export does not establish a particular object chain or code-execution path. The export does not disclose a concrete endpoint, action, parameter, function, or full input-to-operation path beyond those facts. The completed CNA record identifies 3.3.13 as fixed.

Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Strong Testimonials: from n/a through 3.3.12. The CNA vector specifies an attacker with low privileges and does not require victim interaction; the exact WordPress role is not identified for authenticated access. An insufficient authorization check exposes an operation or data beyond the caller's intended permissions. The export does not identify the vulnerable endpoint, action, parameter or function.

Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Strong Testimonials: from n/a through 3.3.12. The CNA vector specifies an attacker with low privileges and does not require victim interaction; the exact WordPress role is not identified for authenticated access. An insufficient authorization check exposes an operation or data beyond the caller's intended permissions. The export does not identify the vulnerable endpoint, action, parameter or function.

The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'platform_user_photo' Custom Field in all versions up to, and including, 3.3.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has added custom text fields named 'platform' and 'platform_user_photo' to a public testimonial submission form, as the plugin does not reserve those internal metadata keys.

Strong Testimonials through 3.3.11 permits stored cross-site scripting: attacker-controlled content can execute scripts when a victim views the affected output. The current CVSS vector requires low privileges and victim interaction, but the revised authoritative description no longer names a minimum WordPress role. The authoritative export does not identify the vulnerable endpoint, action, parameter, function or exact rendering context, so the precise input-to-operation. The authoritative export identifies the fixed release as 3.3.12.

The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lightbox_class' Shortcode Attribute in all versions up to, and including, 3.3.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the targeted testimonial view has at least one published testimonial with a featured image and the lightbox wrapper enabled, as the vulnerable code path is only reached when a thumbnail is rendered. The image and lightbox requirements are essential; the export does not name the submission route or rendering function. Affected versions reported by the CNA: <= 3.3.8.

Strong Testimonials is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 3.2.21.

Strong Testimonials is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

Strong Testimonials is affected by a security weakness. Exploitation requires an authenticated contributor account. The resulting impact depends on how the affected component exposes the vulnerable operation.

Strong Testimonials is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.

Strong Testimonials is affected by cross-site scripting. Exploitation requires an authenticated author account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Strong Testimonials is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

Strong Testimonials is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

Strong Testimonials is affected by a security weakness. Exploitation requires an authenticated contributor account. The resulting impact depends on how the affected component exposes the vulnerable operation.

Strong Testimonials is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Strong Testimonials is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.

Strong Testimonials is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Strong Testimonials is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Strong Testimonials is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.