PT-2020-6781 · WordPress · Easy Testimonials

Published 2020-01-28 · Updated 2020-06-25 · CVE-2020-14959

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Easy Testimonials plugin versions prior to 3.6 for WordPress

Description The issue allows remote attackers to inject arbitrary web script or HTML via certain parameters in the wp-admin/post.php file, including Client Name, Position, Web Address, Other, Location Reviewed, Product Reviewed, Item Reviewed, or Rating. This is due to insufficient protection of the webpage structure when handling these parameters, enabling cross-site scripting (XSS) attacks.

Recommendations For Easy Testimonials plugin versions prior to 3.6, update to version 3.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the wp-admin/post.php file or disabling the parameters Client Name, Position, Web Address, Other, Location Reviewed, Product Reviewed, Item Reviewed, and Rating until the update is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2022-06375

CVE-2020-14959

Affected Products

Easy Testimonials

References · 5

• 🔥 https://wpvulndb.com/vulnerabilities/10223 · Exploit
• https://osv.dev/vulnerability/CVE-2020-14959 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-14959 · Security Note
• https://bdu.fstec.ru/vul/2022-06375 · Security Note
• https://fortiguard.com/zeroday/FG-VD-20-029 · Note