Description
Cross-Site Request Forgery (CSRF) vulnerability in plumwd Web Testimonials web-testimonials allows Stored XSS.This issue affects Web Testimonials: from n/a through <= 1.2.
Published: 2025-01-16
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A Cross‑Site Request Forgery flaw in the Web Testimonials plugin allows an attacker to forge an authorized request that inserts arbitrary JavaScript into testimonial content. The injected code is stored and will run in the browsers of any user who views the impacted testimonial. This Stored XSS can steal session cookies, deface pages, or redirect users to malicious sites.

Affected Systems

The vulnerability affects the WordPress Web Testimonials plugin from unknown initial releases through version 1.2. Any WordPress site that has the plugin installed at or below this version is impacted.

Risk and Exploitability

The CVSS score of 7.1 indicates a high severity exploit. The EPSS score is below 1 %, so active exploitation is currently rare. The vulnerability is not listed in CISA KEV. Attackers can likely exploit it by crafting a CSRF payload either via a link or form, requiring the target to be authenticated admin or a logged‑in user. No specific network requirement is stated, but the exploit requires the victim to have the plugin installed and active.

Generated by OpenCVE AI on May 1, 2026 at 21:10 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade WordPress Web Testimonials to any version higher than 1.2 to remove the CVE‑affected code.
  • If an upgrade is not immediately possible, install a CSRF protection layer by adding WordPress nonces or referer checks to all forms that modify testimonial content.
  • Disable or uninstall the Web Testimonials plugin until a patched version is available.
  • After applying a fix, perform a scan of testimonial content for hidden scripts and remove any suspicious entries.

Generated by OpenCVE AI on May 1, 2026 at 21:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-3248 Cross-Site Request Forgery (CSRF) vulnerability in Elke Hinze, Plumeria Web Design Web Testimonials allows Stored XSS.This issue affects Web Testimonials: from n/a through 1.2.
History

Thu, 23 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Wed, 01 Apr 2026 23:45:00 +0000

Type Values Removed Values Added
Description Cross-Site Request Forgery (CSRF) vulnerability in Elke Hinze, Plumeria Web Design Web Testimonials allows Stored XSS.This issue affects Web Testimonials: from n/a through 1.2. Cross-Site Request Forgery (CSRF) vulnerability in plumwd Web Testimonials web-testimonials allows Stored XSS.This issue affects Web Testimonials: from n/a through <= 1.2.
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Fri, 17 Jan 2025 20:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 16 Jan 2025 20:15:00 +0000

Type Values Removed Values Added
Description Cross-Site Request Forgery (CSRF) vulnerability in Elke Hinze, Plumeria Web Design Web Testimonials allows Stored XSS.This issue affects Web Testimonials: from n/a through 1.2.
Title WordPress Web Testimonials plugin <= 1.2 - CSRF to Stored XSS vulnerability
Weaknesses CWE-352
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-28T16:11:13.122Z

Reserved: 2025-01-16T11:26:13.958Z

Link: CVE-2025-23560

cve-icon Vulnrichment

Updated: 2025-01-17T17:21:34.928Z

cve-icon NVD

Status : Deferred

Published: 2025-01-16T20:15:39.797

Modified: 2026-06-17T08:55:22.333

Link: CVE-2025-23560

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-01T21:15:25Z

Weaknesses
  • CWE-352

    Cross-Site Request Forgery (CSRF)