PT-2023-29670 · WordPress · Easy Testimonial Slider/Form

Rio Darmawan · Published 2023-10-24 · Updated 2024-03-28 · CVE-2023-45754

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Easy Testimonial Slider and Form versions 1.0.18 and earlier

Description The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting (XSS). This means that an attacker can inject malicious scripts into the website, potentially leading to unauthorized access or control. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.

Technical details about exploitation include the fact that it is a stored XSS vulnerability, which means the malicious script is stored on the server and executed whenever a user accesses the affected page. No specific API endpoints, vulnerable parameters, or function names are mentioned.

Recommendations For versions 1.0.18 and earlier, update to a version later than 1.0.18 to resolve the issue. As a temporary workaround, consider restricting access to the Easy Testimonial Slider and Form plugin until a patch is available. Avoid using the plugin's functionality that allows user input until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-45754

Affected Products

Easy Testimonial Slider/Form

References · 5

• https://osv.dev/vulnerability/CVE-2023-45754 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-45754 · Security Note
• https://t.me/cvenotify/74978 · Telegram Post
• https://twitter.com/CVEnew/status/1716781177296585171 · Twitter Post
• https://patchstack.com/database/vulnerability/easy-testimonial-rotator/wordpress-easy-testimonial-slider-and-form-plugin-1-0-18-cross-site-scripting-xss?_s_id=cve · Note