Description
WordPress Plugin HMS Testimonials is prone to multiple cross-site scripting and cross-site request forgery vulnerabilities. An attacker can exploit these vulnerabilities to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, disclose or modify sensitive information, or perform unauthorized actions; other attacks are also possible. WordPress Plugin HMS Testimonials version 2.0.10 is vulnerable; prior versions may also be affected.
Remediation
Update to plugin version 2.0.11 or latest
References
http://seclists.org/fulldisclosure/2013/Aug/98
http://packetstormsecurity.com/files/122761/WordPress-HMS-Testimonials-2.0.10-XSS-CSRF.html
Related Vulnerabilities
Moodle CVE-2021-32473 Vulnerability (CVE-2021-32473)
PostgreSQL Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2016-5424)
TYPO3 Permissions, Privileges, and Access Controls Vulnerability (CVE-2010-3714)
phpBB Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2008-0471)
Oracle Database Server CVE-2011-2231 Vulnerability (CVE-2011-2231)