CVE-2023-4795

Summary

CVE-2023-4795 is a stored Cross-Site Scripting (XSS) vulnerability affecting the Testimonial Slider Shortcode plugin for WordPress. Prior to version 1.1.9, this plugin fails to validate and escape certain shortcode attributes before rendering them on webpages. This oversight permits contributors, and potentially other low-privilege users, to inject malicious scripts. These scripts can be executed when high-privilege users, such as administrators, view the affected webpage, resulting in unintended code execution and potential data theft or unauthorized access to sensitive information.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.