CVE-2021-24136: Axelerant Testimonials Widget

Medium severity, CVSS 5.4. EPSS: 0.8% chance of exploitation in the next 30 days.

Unvalidated input and lack of output encoding in the Testimonials Widget WordPress plugin, versions before 4.0.0, lead to multiple Cross-Site Scripting vulnerabilities, allowing remote attackers to inject arbitrary JavaScript code or HTML via the below parameters: - Author - Job Title - Location - Company - Email - URL

Affected products

• Axelerant Testimonials Widget: before 4.0.0 (fixed in 4.0.0)

Published 2021-03-18. Last modified 2026-06-17.