CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N
What the vulnerability does
Authenticated (editor or higher user role) Cross-Site Scripting (XSS) vulnerability in Web-Settler Testimonial Slider – Free Testimonials Slider Plugin (WordPress plugin) via parameters mpsp_posts_bg_color, mpsp_posts_description_color, mpsp_slide_nav_button_color.
Explanation of Vulnerability in Simple Terms
The Testimonial Slider plugin for WordPress versions up to 3.5.8.3 contains a stored cross-site scripting (XSS) vulnerability. An authenticated administrator can inject malicious JavaScript into testimonial content that executes in the browsers of site visitors. The vulnerability requires high-level privileges to exploit but affects all users viewing the site.
What an attacker can do
Inject JavaScript code that runs in visitors' browsers when they view testimonials.
Potential impact on your site
Site visitors may be redirected, have sessions hijacked, or see malicious content injected by a compromised admin account.
Conditions required to exploit
Attacker must have WordPress administrator access; no user interaction required.
Key dates
External resources
Related vulnerabilities
