CVE-2013-4241

Multiple cross-site scripting (XSS) vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) image, (3) url, or (4) testimonial parameter to the Testimonial form (hms-testimonials-addnew page); (5) date_format parameter to the Settings - Default form (hms-testimonials-settings page); (6) name parameter in a Save action to the Settings - Custom Fields form (hms-testimonials-settings-fields page); or (7) name parameter in a Save action to the Settings - Template form (hms-testimonials-templates-new page).

• CWE-79

• http://seclists.org/fulldisclosure/2013/Aug/96Exploit, Mailing List, Third Party Advisory
• http://seclists.org/fulldisclosure/2013/Aug/98Exploit, Mailing List, Third Party Advisory
• http://seclists.org/oss-sec/2013/q3/345Mailing List, Third Party Advisory
• http://seclists.org/oss-sec/2013/q3/361Mailing List, Third Party Advisory
• https://wordpress.org/plugins/hms-testimonials/#developersRelease Notes
• http://seclists.org/fulldisclosure/2013/Aug/96Exploit, Mailing List, Third Party Advisory
• http://seclists.org/fulldisclosure/2013/Aug/98Exploit, Mailing List, Third Party Advisory
• http://seclists.org/oss-sec/2013/q3/345Mailing List, Third Party Advisory
• http://seclists.org/oss-sec/2013/q3/361Mailing List, Third Party Advisory
• https://wordpress.org/plugins/hms-testimonials/#developersRelease Notes

Published

Jan 30, 2020

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2013-4235shadow: TOCTOU (time-of-check time-of-use) race condition wh…4.7
• CVE-2013-4236VDSM in Red Hat Enterprise Virtualization 3 and 3.2 allows p…
• CVE-2013-4237sysdeps/posix/readdir_r.c in the GNU C Library (aka glibc or…
• CVE-2013-4238The ssl.match_hostname function in the SSL module in Python …
• CVE-2013-4239The xenDaemonListDefinedDomains function in xen/xend_interna…
• CVE-2013-4240Multiple cross-site request forgery (CSRF) vulnerabilities i…
• CVE-2013-4242GnuPG before 1.4.14, and Libgcrypt before 1.5.3 as used in G…
• CVE-2013-4243Heap-based buffer overflow in the readgifimage function in t…
• CVE-2013-4244The LZW decompressor in the gif2tiff tool in libtiff 4.0.3 a…
• CVE-2013-4245Orca has arbitrary code execution due to insecure Python mod…7.3
• CVE-2013-4246libsvn_fs_fs/fs_fs.c in Apache Subversion 1.8.x before 1.8.2…
• CVE-2013-4247Off-by-one error in the build_unc_path_to_root function in f…