Gs Testimonial Slider
Monthly
PHP object injection in the WordPress plugin GS Testimonial Slider (versions up to and including 3.3.10) allows an authenticated user with Contributor-level privileges to submit crafted serialized input that the plugin deserializes, potentially leading to high-impact confidentiality, integrity and availability effects (CVSS 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Because the vector requires PR:L, anonymous exploitation is not possible; the risk is concentrated on sites that grant Contributor accounts freely or with loose vetting. Actual code execution depends on a usable POP gadget chain being present in the plugin, WordPress core, or other installed plugins/themes, and the exact injectable parameter or sink is not described in the available sources. No public exploit code has been identified at time of analysis; the issue is a prioritization candidate for this week rather than an emergency, and no fixed version is listed in the available data.
Multiple Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in GS Testimonial Slider plugin <= 1.9.6 at WordPress. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in GS Plugins GS Testimonial Slider plugin <= 1.9.5 at WordPress. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
PHP object injection in the WordPress plugin GS Testimonial Slider (versions up to and including 3.3.10) allows an authenticated user with Contributor-level privileges to submit crafted serialized input that the plugin deserializes, potentially leading to high-impact confidentiality, integrity and availability effects (CVSS 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Because the vector requires PR:L, anonymous exploitation is not possible; the risk is concentrated on sites that grant Contributor accounts freely or with loose vetting. Actual code execution depends on a usable POP gadget chain being present in the plugin, WordPress core, or other installed plugins/themes, and the exact injectable parameter or sink is not described in the available sources. No public exploit code has been identified at time of analysis; the issue is a prioritization candidate for this week rather than an emergency, and no fixed version is listed in the available data.
Multiple Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in GS Testimonial Slider plugin <= 1.9.6 at WordPress. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in GS Plugins GS Testimonial Slider plugin <= 1.9.5 at WordPress. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.