CVE-2021-24156

Stored Cross-Site Scripting vulnerabilities in Testimonial Rotator 3.0.3 allow low privileged users (Contributor) to inject arbitrary JavaScript code or HTML without approval. This could lead to privilege escalation

CVSS v3.1

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0

3.5 LOWAV:N/AC:M/Au:S/C:N/I:P/A:N

EPSS

0.69% chance of exploitation in the next 30 days, 50th percentile

Published

2021-04-05

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/8b6f4a77-4008-4730-9a91-fa055a8b3e68

References

• CVE Record
• NVD entry

Related

• CVE-2021-24155
• CVE-2021-24157
• CVE-2021-24153
• CVE-2021-24158
• CVE-2021-24151
• CVE-2021-24160