vulnerability

WordPress Plugin: testimonial-add: CVE-2021-36851: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Try Surface Command

Back to search

Severity

CVSS

(AV:N/AC:M/Au:S/C:N/I:P/A:N)

Published

Apr 4, 2022

Added

May 15, 2025

Modified

Apr 29, 2026

Description

Authenticated (editor or higher user role) Cross-Site Scripting (XSS) vulnerability in Web-Settler Testimonial Slider – Free Testimonials Slider Plugin (WordPress plugin) via parameters mpsp_posts_bg_color, mpsp_posts_description_color, mpsp_slide_nav_button_color.

Solution

testimonial-add-plugin-cve-2021-36851

References

https://www.cve.org/CVERecord?id=CVE-2021-36851
https://www.wordfence.com/threat-intel/vulnerabilities/id/3b1bfe88-2513-4acc-91e2-50a3bc9d7183?source=api-prod
https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-23427
CVE-2021-36851
https://attackerkb.com/topics/CVE-2021-36851
CWE-79
EUVD-EUVD-2021-23427

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report