Vulnerability · Published Jun 27, 2023 · Assigned by WPScan
CVE-2023-2178Aajoda Testimonials < 2.2.2 - Admin+ Stored XSS
Medium 4.8
In plain English
A medium-severity security flaw in Aajoda Testimonials from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Severity (CVSS NVD)4.8Medium
Exploit odds (30 days)0.8%top 44.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Nuclei
Official description
The Aajoda Testimonials WordPress plugin before 2.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Aajoda Testimonials | 0 – before 2.2.2 |
References
- https://wpscan.com/vulnerability/e84b71f9-4208-4efb-90e8-1c778e7d2ebb exploit, vdb-entry, technical-description