CVE-2013-4241

MediumCVSS 6.1/10Last modified Jun 16, 2026

Description

Multiple cross-site scripting (XSS) vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) image, (3) url, or (4) testimonial parameter to the Testimonial form (hms-testimonials-addnew page); (5) date_format parameter to the Settings - Default form (hms-testimonials-settings page); (6) name parameter in a Save action to the Settings - Custom Fields form (hms-testimonials-settings-fields page); or (7) name parameter in a Save action to the Settings - Template form (hms-testimonials-templates-new page).

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
HitMyServer	HMS Testimonials	before 2.0.11

References

http://seclists.org/fulldisclosure/2013/Aug/96Exploit, Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2013/Aug/98Exploit, Mailing List, Third Party Advisory
http://seclists.org/oss-sec/2013/q3/345Mailing List, Third Party Advisory
http://seclists.org/oss-sec/2013/q3/361Mailing List, Third Party Advisory
https://wordpress.org/plugins/hms-testimonials/#developersRelease Notes
http://seclists.org/fulldisclosure/2013/Aug/96Exploit, Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2013/Aug/98Exploit, Mailing List, Third Party Advisory
http://seclists.org/oss-sec/2013/q3/345Mailing List, Third Party Advisory
http://seclists.org/oss-sec/2013/q3/361Mailing List, Third Party Advisory
https://wordpress.org/plugins/hms-testimonials/#developersRelease Notes

Timeline

Published: Jan 30, 2020
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-42421.9GnuPG before 1.4.14, and Libgcrypt before 1.5.3 as used in GnuPG 2.0.x and possibly other products, allows local users to obtain private RSA CVE-2013-42436.8Heap-based buffer overflow in the readgifimage function in the gif2tiff tool in libtiff 4.0.3 and earlier allows remote attackers to cause a CVE-2013-42446.8The LZW decompressor in the gif2tiff tool in libtiff 4.0.3 and earlier allows context-dependent attackers to cause a denial of service (out-CVE-2013-42457.3Orca has arbitrary code execution due to insecure Python module load CVE-2013-42468.8libsvn_fs_fs/fs_fs.c in Apache Subversion 1.8.x before 1.8.2 might allow remote authenticated users with commit access to corrupt FSFS repos CVE-2013-42477.8Off-by-one error in the build_unc_path_to_root function in fs/cifs/connect.c in the Linux kernel before 3.9.6 allows remote attackers to cau CVE-2013-42484.3The openssl_x509_parse function in openssl.c in the OpenSSL module in PHP before 5.4.18 and 5.5.x before 5.5.2 does not properly handle a '\CVE-2013-42494.3Cross-site scripting (XSS) vulnerability in the AdminURLFieldWidget widget in contrib/admin/widgets.py in Django 1.5.x before 1.5.2 and 1.6.CVE-2013-42506.5The (1) file upload component and (2) File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.8 and 6.1.x before 6.1.3 do not properly check CVE-2013-42517.8The scipy.weave component in SciPy before 0.12.1 creates insecure temporary directories.CVE-2013-42537.5The deployment script in the unsupported "OpenShift Extras" set of add-on scripts, in Red Hat Openshift 1, installs a default public key in CVE-2013-42546.9The validate_event function in arch/arm/kernel/perf_event.c in the Linux kernel before 3.10.8 on the ARM platform allows local users to gain