title: Handsome Testimonials & Reviews < 2.1.1 - Authenticated (Subscriber+) SQL Injection
description: The hndtst_action_instance_callback AJAX call of the Handsome Testimonials & Reviews WordPress plugin before 2.1.1, available to any authenticated users, does not sanitise, validate or escape the hndtst_previewShortcodeInstanceId POST parameter before using it in a SQL statement, leading to an SQL Injection issue.
problem types: CWE-89 SQL Injection
affected:
{
product: Handsome Testimonials & Reviews
vendor: Unknown
versions:
lessThan: 2.1.1, status: affected, version: 2.1.1, versionType: custom
}