CVE-2025-49410 CRITICAL

CVE-2025-49410: WordPress TC Testimonials plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability

Vendor Imran Emu

Product TC Testimonials

Weakness CWE-79 · XSS

Published August 20, 2025

Last update April 28, 2026

View on NVD All CVEs

CVSS base score

10.0/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Imran Emu TC Testimonials allows Stored XSS. This issue affects TC Testimonials: from n/a through 1.1.1.

Explanation of Vulnerability in Simple Terms

02Summary

TC Testimonials versions up to 1.1.1 contain a cross-site scripting (XSS) vulnerability that allows unauthenticated attackers to inject malicious scripts into the site without user interaction. The vulnerability affects the entire scope of the application and can compromise confidentiality, integrity, and availability. Site administrators should update immediately to a patched version.

What an attacker can do

03Attacker Capabilities

Inject malicious JavaScript that runs in visitors' browsers, steal session cookies, deface content, or redirect users to phishing sites.

Potential impact on your site

04Site Impact

Visitors' browsers can be compromised; site reputation and user data at risk without immediate patching.

Conditions required to exploit

05Prerequisites

Network access only; no authentication or user interaction required.

Key dates

06Disclosure timeline

August 20, 2025 CVE published

April 28, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-49410 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html AskarLabs — CWE-79 write-up Cross-Site Scripting

Related vulnerabilities