Description

The WP Testimonials WordPress plugin through 1.4.13 does not properly escape testimonial content and reverses WordPress's HTML sanitization when rendering it, allowing users with the Author role and above to store JavaScript that executes in the session of any user viewing the testimonials, including administrators.

Related CPE's

Could not find any relations

References

https://wpscan.com/vulnerability/feff4b89-6ae6-487a-9187-ecb70778c83c/

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0

Secondary
CWE-79

CVSS impact metrics

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

6.8 · Medium

Information

Source identifier

[email protected]

Vulnerability status

Deferred

Published

2026-10-13T06:17:03.683Z

11 hours ago

Last modified

2026-10-13T16:29:21.907Z

59 minutes ago