The vulnerability is a stored cross‐site scripting flaw in the "post_title" parameter of the WordPress plugin Testimonial Slider and Showcase. Unsanitized input allows an authenticated editor to inject JavaScript into the testimonial title, which executes when other users view the draft post. This can enable cookie theft and session hijacking on the visitor’s browser.

The affected product is the RadiusTheme Testimonial Slider and Showcase plugin for WordPress, version 2.2.6. Only users with editor privileges in WordPress can exploit the flaw, as the injection occurs during testimonial creation or editing within the admin interface.

The CVSS score of 5.1 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. The attack requires a valid editor account or the ability to add a testimonial, so the threat surface is limited to sites with editor roles or compromised credentials. Once exploited, the injected script runs in the context of any user viewing the affected testimonial, which can lead to cookie theft and session hijacking. The risk is moderate but the impact on visitor data and session integrity can be significant.