CVE-2024-4193

MediumCVSS 6.4/10Last modified Jun 17, 2026

Description

The Testimonial Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'testimonialcategory' shortcode in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: May 14, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-419306.1Cross-site scripting vulnerability exists in MF Teacher Performance Management System version 6. If this vulnerability is exploited, an arbi CVE-2024-419314.3The goTenna Pro ATAK Plugin encryption key name is always sent unencrypted when the key is sent over RF through a broadcast message. It is CVE-2024-419325.5In the Linux kernel, the following vulnerability has been resolved: sched: fix warning in sched_setaffinity Commit 8f9ea86fdf99b added som CVE-2024-419345.9Improper access control in some Intel(R) GPA software before version 2024.3 may allow an authenticated user to potentially enable denial of CVE-2024-419357.1In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to shrink read extent node in batches We use rwlock to prote CVE-2024-419367.5A directory traversal vulnerability affecting Vonets industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 CVE-2024-419376.1Apache Airflow, versions before 2.10.0, have a vulnerability that allows the developer of a malicious provider to execute a cross-site scrip CVE-2024-419383.8A vulnerability has been identified in SINEC NMS (All versions < V3.0). The importCertificate function of the SINEC NMS Control web applicat CVE-2024-419398.8A vulnerability has been identified in SINEC NMS (All versions < V3.0). The affected application does not properly enforce authorization che CVE-2024-41947.3The The Album and Image Gallery plus Lightbox plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and CVE-2024-419409.1A vulnerability has been identified in SINEC NMS (All versions < V3.0). The affected application does not properly validate user input to a CVE-2024-419414.3A vulnerability has been identified in SINEC NMS (All versions < V3.0). The affected application does not properly enforce authorization che