CVE-2020-8549
Stored XSS in the Strong Testimonials plugin before 2.40.1 for WordPress can result in an...
Stored XSS in the Strong Testimonials plugin before 2.40.1 for WordPress can result in an attacker performing malicious actions such as stealing session tokens.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Stored XSS in the Strong Testimonials plugin before 2.40.1 for WordPress can result in an attacker performing malicious actions such as stealing session tokens.
- Record
CVE-2020-8549- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Stored XSS in the Strong Testimonials plugin before 2.40.1 for WordPress can result in an attacker performing malicious actions such as stealing session tokens.
- Record
CVE-2020-8549- Updated
- 2026-11-02
EUVDEUVD-2020-29415 No score
Stored XSS in the Strong Testimonials plugin before 2.40.1 for WordPress can result in an attacker performing malicious actions such as stealing session tokens.
- Record
EUVD-2020-29415- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4x75-37xv-wgwv
Stored XSS in the Strong Testimonials plugin before 2.40.1 for WordPress can result in an...
Stored XSS in the Strong Testimonials plugin before 2.40.1 for WordPress can result in an attacker performing malicious actions such as stealing session tokens.
- Record
GHSA-4x75-37xv-wgwv- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-8549 is a medium vulnerability (CVSS 6.1) in Wpchill Strong Testimonials, published February 3, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.88%, the 79th percentile. No source names a fixed version.
References
wpvulndb.com/vulnerabilities/10056
github.com/MachoThemes/strong-testimonials/blob/master/changelog.txt
getastra.com/blog/911/plugin-exploit/stored-xss-vulnerability-found-in-strong-testimonials-plugin
jinsonvarghese.com/stored-xss-vulnerability-in-strong-testimonials-plugin
packetstormsecurity.com/files/156369/WordPress-Strong-Testimonials-2.40.1-Cross-Site-Scripting.html
nvd.nist.gov/vuln/detail/CVE-2020-8549