CVE-2024-4705

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Testimonials Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's testimonials shortcode in all versions up to, and including, 4.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jun 6, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-470506.1Prior to this patch being applied, Mautic's tracking was vulnerable to Cross-Site Scripting through the Page URL variable.CVE-2024-470519.9This advisory addresses two critical security vulnerabilities present in Mautic versions before 5.2.3. These vulnerabilities could be exploi CVE-2024-470537.7This advisory addresses an authorization vulnerability in Mautic's HTTP Basic Authentication implementation. This flaw could allow unauthori CVE-2024-470554.3SummaryThis advisory addresses a security vulnerability in Mautic related to the segment cloning functionality. This vulnerability allows an CVE-2024-470565.1SummaryThis advisory addresses a security vulnerability in Mautic where sensitive .env configuration files may be directly accessible via a CVE-2024-470575.3SummaryThis advisory addresses a security vulnerability in Mautic related to the "Forget your password" functionality. This vulnerability co CVE-2024-470584.8With access to edit a Mautic form, the attacker can add Cross-Site Scripting stored in the html filed. This could be used to steal sensitive CVE-2024-470594.3When logging in with the correct username and incorrect weak password, the user receives the notification, that their password is too weak. CVE-2024-47066.4The WordPress + Microsoft Office 365 / Azure AD | LOGIN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'CVE-2024-470606.5Zitadel is an open source identity management platform. In Zitadel, even after an organization is deactivated, associated projects, respecti CVE-2024-470618.3Plate is a javascript toolkit that makes it easier for you to develop with Slate, a popular framework for building text editors. One longsta CVE-2024-470628.8Navidrome is an open source web-based music collection server and streamer. Navidrome automatically adds parameters in the URL to SQL querie