CVE-2020-8549

Stored XSS in the Strong Testimonials plugin before 2.40.1 for WordPress can result in an attacker performing malicious actions such as stealing session tokens.

• CWE-79

• http://packetstormsecurity.com/files/156369/WordPress-Strong-Testimonials-2.40.1-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
• https://github.com/MachoThemes/strong-testimonials/blob/master/changelog.txtRelease Notes, Third Party Advisory
• https://wpvulndb.com/vulnerabilities/10056Third Party Advisory
• https://www.getastra.com/blog/911/plugin-exploit/stored-xss-vulnerability-found-in-strong-testimonials-plugin/Exploit, Third Party Advisory
• https://www.jinsonvarghese.com/stored-xss-vulnerability-in-strong-testimonials-plugin/Exploit, Third Party Advisory
• http://packetstormsecurity.com/files/156369/WordPress-Strong-Testimonials-2.40.1-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
• https://github.com/MachoThemes/strong-testimonials/blob/master/changelog.txtRelease Notes, Third Party Advisory
• https://wpvulndb.com/vulnerabilities/10056Third Party Advisory
• https://www.getastra.com/blog/911/plugin-exploit/stored-xss-vulnerability-found-in-strong-testimonials-plugin/Exploit, Third Party Advisory
• https://www.jinsonvarghese.com/stored-xss-vulnerability-in-strong-testimonials-plugin/Exploit, Third Party Advisory

Published

Feb 3, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-8542OX App Suite through 7.10.3 allows XSS.5.4
• CVE-2020-8543OX App Suite through 7.10.3 has Improper Input Validation.7.5
• CVE-2020-8544OX App Suite through 7.10.3 allows SSRF.6.5
• CVE-2020-8545Global.py in AIL framework 2.8 allows path traversal.7.5
• CVE-2020-8547phpList 3.5.0 allows type juggling for admin login bypass be…9.8
• CVE-2020-8548massCode 1.0.0-alpha.6 allows XSS via crafted Markdown text,…6.1
• CVE-2020-8551The Kubelet component in versions 1.15.0-1.15.9, 1.16.0-1.16…6.5
• CVE-2020-8552The Kubernetes API server component in versions prior to 1.1…4.3
• CVE-2020-8553The Kubernetes ingress-nginx component prior to version 0.28…5.9
• CVE-2020-8554Kubernetes API server in all versions allow an attacker who …5
• CVE-2020-8555The Kubernetes kube-controller-manager in versions v1.0-1.14…6.3
• CVE-2020-8557The Kubernetes kubelet component in versions 1.1-1.16.12, 1.…5.5