CVE-2024-9127

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Super Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘alignment’ parameter in all versions up to, and including, 3.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Sep 26, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-91299.3In versions of Zend Server 8.5 and prior to version 9.2 a format string injection was discovered. Reported by Dylan MarinoCVE-2024-91307.2The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parametCVE-2024-91317.2A user with administrator privileges can perform command injectionCVE-2024-91329.8The administrator is able to configure an insecure captive portal scriptCVE-2024-91335.6A user with administrator privileges is able to retrieve authentication tokensCVE-2024-91348.3Multiple SQL Injection vulnerabilities exist in the reporting application. A user with advanced report application access rights can exploiCVE-2024-91355.3On affected platforms running Arista EOS with BGP Link State configured, BGP peer flap can cause the BGP agent to leak memory. This may resuCVE-2024-91367.5Access permission verification vulnerability in the App Multiplier module Impact: Successful exploitation of this vulnerability may affect sCVE-2024-91379.4The affected product lacks an authentication check when sending commands to the server via the Moxa service. This vulnerability allows an atCVE-2024-91387.2Moxa’s cellular routers, secure routers, and network security appliances are affected by a high-severity vulnerability, CVE-2024-9138. This CVE-2024-91397.2The affected product permits OS command injection through improperly restricted commands, potentially allowing attackers to execute arbitrarCVE-2024-91409.8Moxa’s cellular routers, secure routers, and network security appliances are affected by a critical vulnerability, CVE-2024-9140. This vulne