CVE-2024-11429

The Free Responsive Testimonials, Social Proof Reviews, and Customer Reviews – Stars Testimonials plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.3 via the 'stars-testimonials-with-slider-and-masonry-grid' shortcode. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary PHP files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where PHP files can be uploaded and included.

• CWE-98

• https://plugins.trac.wordpress.org/browser/stars-testimonials-with-slider-and-masonry-grid/tags/3.3.2/plugin.class.php#L1368
• https://plugins.trac.wordpress.org/browser/stars-testimonials-with-slider-and-masonry-grid/trunk/plugin.class.php#L1368
• https://www.wordfence.com/threat-intel/vulnerabilities/id/68250b6c-22c8-494f-b0b0-62b80cc4de0c?source=cve

Published

Dec 5, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-11423The Ultimate Gift Cards for WooCommerce – Create WooCommerce…7.5
• CVE-2024-11424The Slick Sitemap plugin for WordPress is vulnerable to Stor…6.4
• CVE-2024-11425CWE-131: Incorrect Calculation of Buffer Size vulnerability …8.7
• CVE-2024-11426The AutoListicle: Automatically Update Numbered List Article…6.4
• CVE-2024-11427The Catch Popup plugin for WordPress is vulnerable to Stored…6.4
• CVE-2024-11428The Lazy load videos and sticky control plugin for WordPress…6.4
• CVE-2024-1143Central Dogma versions prior to 0.64.1 is vulnerable to Cros…6.1
• CVE-2024-11430The SQL Chart Builder plugin for WordPress is vulnerable to …6.5
• CVE-2024-11431The Ragic Shortcode plugin for WordPress is vulnerable to St…6.4
• CVE-2024-11432The SuevaFree Essential Kit plugin for WordPress is vulnerab…6.4
• CVE-2024-11433The Surbma | SalesAutopilot Shortcode plugin for WordPress i…6.4
• CVE-2024-11434The WP – Bulk SMS – by SMS.to plugin for WordPress is vulner…6.1