PT-2022-22793 · WordPress · Testimonial Wordpress Plugin+1

Asif Nawaz Minhas · Published 2022-11-14 · Updated 2026-01-07 · CVE-2022-3539

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Testimonials WordPress plugin versions prior to 2.7 super-testimonial-pro WordPress plugin versions prior to 1.0.8

Description The issue allows high privilege users, such as admins, to perform cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, due to the lack of sanitization and escaping of its settings.

Recommendations For Testimonials WordPress plugin versions prior to 2.7, update to version 2.7 or later. For super-testimonial-pro WordPress plugin versions prior to 1.0.8, update to version 1.0.8 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-3539

Affected Products

Testimonial Wordpress Plugin

Super-Testimonial-Pro Wordpress Plugin

References · 6

• 🔥 https://wpscan.com/vulnerability/ab3b0052-1a74-4ba3-b6d2-78cfe56029db · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-3539 · Security Note
• https://osv.dev/vulnerability/CVE-2022-3539 · Vendor Advisory
• https://t.me/cvenotify/120338 · Telegram Post
• https://t.me/cibsecurity/52976 · Telegram Post
• https://t.me/cveNotify/147967 · Telegram Post