CVE-2021-24492: Handsome Testimonials & Reviews Project Handsome Testimonials & Reviews

High severity, CVSS 8.8. EPSS: 1.6% chance of exploitation in the next 30 days.

The hndtst_action_instance_callback AJAX call of the Handsome Testimonials & Reviews WordPress plugin before 2.1.1, available to any authenticated users, does not sanitise, validate or escape the hndtst_previewShortcodeInstanceId POST parameter before using it in a SQL statement, leading to an SQL Injection issue.

Affected products

• Handsome Testimonials & Reviews Project Handsome Testimonials & Reviews: before 2.1.1 (fixed in 2.1.1)

Published 2021-08-02. Last modified 2026-06-17.