CVE-2024-1746: Testimonial Slider < 2.3.8 - Admin+ Stored XSS
The Testimonial Slider WordPress plugin before 2.3.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed (for example in multisite setup)
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1746?
CVE-2024-1746 is considered a high severity vulnerability due to the potential for Stored Cross-Site Scripting attacks.
How do I fix CVE-2024-1746?
To fix CVE-2024-1746, update the Testimonial Slider WordPress plugin to version 2.3.8 or later.
Who is affected by CVE-2024-1746?
CVE-2024-1746 affects high privilege users, such as admins, using the Testimonial Slider plugin prior to version 2.3.8.
What is the risk associated with CVE-2024-1746?
The risk associated with CVE-2024-1746 includes the ability for attackers to execute malicious scripts in the context of the user’s browser.
Can CVE-2024-1746 be exploited in multisite environments?
Yes, CVE-2024-1746 can be exploited in multisite environments even if the unfiltered_html capability is disallowed.