CVSS base score
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
What the vulnerability does
WordPress Plugin Testimonial Slider and Showcase 2.2.6 contains a stored cross-site scripting vulnerability that allows authenticated editors to inject malicious scripts by failing to sanitize the post_title parameter. Attackers with editor privileges can inject JavaScript payloads through the testimonial title field that execute in the browsers of users viewing the draft post, enabling cookie theft and session hijacking.
Explanation of Vulnerability in Simple Terms
Testimonial Slider and Showcase contains a cross-site scripting (XSS) vulnerability in version 2.2.6. An authenticated user with low privileges can inject malicious scripts that execute in other users' browsers when they view affected pages. The vulnerability requires user interaction to trigger. Update to a patched version to remediate.
What an attacker can do
Inject JavaScript that runs in other users' browsers and steals session tokens or perform actions on their behalf.
Potential impact on your site
Authenticated users can compromise other users' accounts or sessions through malicious script injection on your site.
Conditions required to exploit
Attacker must have a low-privilege account on the site; victim must visit a page containing the injected payload.
Key dates
External resources
Related vulnerabilities
