CVE-2020-8549

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Stored XSS in the Strong Testimonials plugin before 2.40.1 for WordPress can result in an attacker performing malicious actions such as stealing session tokens.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/156369/WordPress-Strong-Testimonials-2.40.1-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
https://github.com/MachoThemes/strong-testimonials/blob/master/changelog.txtRelease Notes, Third Party Advisory
https://wpvulndb.com/vulnerabilities/10056Third Party Advisory
https://www.getastra.com/blog/911/plugin-exploit/stored-xss-vulnerability-found-in-strong-testimonials-plugin/Exploit, Third Party Advisory
https://www.jinsonvarghese.com/stored-xss-vulnerability-in-strong-testimonials-plugin/Exploit, Third Party Advisory
http://packetstormsecurity.com/files/156369/WordPress-Strong-Testimonials-2.40.1-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
https://github.com/MachoThemes/strong-testimonials/blob/master/changelog.txtRelease Notes, Third Party Advisory
https://wpvulndb.com/vulnerabilities/10056Third Party Advisory
https://www.getastra.com/blog/911/plugin-exploit/stored-xss-vulnerability-found-in-strong-testimonials-plugin/Exploit, Third Party Advisory
https://www.jinsonvarghese.com/stored-xss-vulnerability-in-strong-testimonials-plugin/Exploit, Third Party Advisory

Timeline

Published: Feb 3, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-85516.5The Kubelet component in versions 1.15.0-1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be vulnerable to a denial of service att CVE-2020-85524.3The Kubernetes API server component in versions prior to 1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be vulnerable to a denia CVE-2020-85535.9The Kubernetes ingress-nginx component prior to version 0.28.0 allows a user with the ability to create namespaces and to read and create in CVE-2020-85545.0Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to int CVE-2020-85556.3The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerab CVE-2020-85575.5The Kubernetes kubelet component in versions 1.1-1.16.12, 1.17.0-1.17.8 and 1.18.0-1.18.5 do not account for disk usage by a pod which write CVE-2020-85588.8The Kubelet and kube-proxy components in versions 1.1.0-1.16.10, 1.17.0-1.17.6, and 1.18.0-1.18.3 were found to contain a security issue whi CVE-2020-85596.8The Kubernetes kube-apiserver in versions v1.6-v1.15, and versions prior to v1.16.13, v1.17.9 and v1.18.6 are vulnerable to an unvalidated r CVE-2020-85614.1A security issue was discovered in Kubernetes where actors that control the responses of MutatingWebhookConfiguration or ValidatingWebhookCo CVE-2020-85623.1As mitigations to a report from 2019 and CVE-2020-8555, Kubernetes attempts to prevent proxied connections from accessing link-local or loca CVE-2020-85635.5In Kubernetes clusters using VSphere as a cloud provider, with a logging level set to 4 or above, VSphere cloud credentials will be leaked i CVE-2020-85645.5In Kubernetes clusters using a logging level of at least 4, processing a malformed docker config file will result in the contents of the doc