Stored XSS in WP Testimonials WordPress Plugin

Executive Summary

The WP Testimonials WordPress plugin through version 1.4.13 has a stored cross-site scripting (XSS) vulnerability. Users with the Author role or higher can inject malicious JavaScript into testimonial content. The plugin fails to properly escape this content and even reverses WordPress's built-in HTML sanitization. When other users, including administrators, view the testimonials, the injected JavaScript executes in their sessions.

Useful 0 Not Useful 0

Detection Guidance

Check if the WP Testimonials plugin version 1.4.13 or below is installed on your WordPress site. Review testimonial content for suspicious JavaScript code or unusual characters. Use WordPress admin tools to inspect stored testimonials for unescaped HTML or script tags.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers with Author-level access or higher to execute malicious JavaScript in the browsers of any user viewing the testimonials. This could lead to session hijacking, theft of sensitive data like cookies or credentials, or unauthorized actions performed on behalf of the victim. Administrators are particularly at risk as their elevated privileges could be exploited.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles and HIPAA's safeguards for protected health information. If exploited, it may result in data breaches, unauthorized processing of personal data, or exposure of sensitive information, potentially leading to regulatory penalties and legal consequences.

Useful 0 Not Useful 0

Mitigation Strategies

Disable the WP Testimonials plugin immediately if installed. Monitor user roles to ensure only trusted users have Author or higher privileges. Check for unauthorized JavaScript in testimonial content. Wait for an official patch or update from the plugin developer.

Useful 0 Not Useful 0