Re: CVE Request - HMS Testimonials 2.0.10 WP plugin

["Adéla Goldová" <roguecoder () hush com>]

I noticed how I managed to spell the name really wrong in the message text. I just wanted to fix it to avoid confusion.
The name should be HMS Testimonials.

On 8/10/2013 at 6:31 PM, "Adéla Goldová" <roguecoder () hush com> wrote:
> Hello
>
> The HMS Tesminoalis version 2.0.10 plugin for WordPress contains 
> multiple CSRF and XSS vulnerabilities.
> This can be used in many different ways, like defacement of both 
> public site and the admin area (only the HMS 
> Testimonials plugin area will be affected), modify settings to set 
> a lower role as moderator (very harmful on sites 
> with open registrations), etc. Could CVE's be assigned to this?
>
> 1: http://seclists.org/fulldisclosure/2013/Aug/96