CVE-2025-49410

WordPress TC Testimonials plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability

View on CVE.org
Published Aug 20, 2025 CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Imran Emu TC Testimonials allows Stored XSS. This issue affects TC Testimonials: from n/a through 1.1.1.

Analysis

AI-generated

Technical impact

Improper neutralization of input during web page generation (CWE‑79) allows stored cross‑site scripting in the Imran Emu TC Testimonials WordPress plugin. A malicious actor can post a testimonial containing a script that is saved and subsequently executed in the browsers of any visitor to the site, potentially leaking confidential data, hijacking sessions or defacing pages.

Affected Systems

The flaw exists in TC Testimonials plugin versions from the earliest release through 1.1.1 on WordPress installations, meaning any site using one of those versions is vulnerable.

Risk and Exploitability

The CVSS score of 10.0 indicates maximum severity, while the EPSS score of less than 1% suggests that active exploitation is currently rare. The vulnerability can be exploited simply by submitting a crafted testimonial that includes malicious markup; if the site allows anonymous or public submissions, even non‑privileged users can trigger the stored XSS. Once the payload is rendered, it runs with the privileges of the visiting user and can lead to information disclosure, credential theft or defacement.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest official patch for the TC Testimonials plugin, or upgrade to a version newer than 1.1.1 if available.
  • If an update is not possible, disable or uninstall the TC Testimonials plugin to prevent the storage of malicious content.
  • Configure a web application firewall or add input‑filtering rules to block or sanitize scripts submitted in testimonial fields, following best practices for guarding against CWE‑79.
  • Periodically check the vendor’s website or the plugin’s repository for new security releases and apply them promptly.

Generated by OpenCVE AI on May 1, 2026 at 06:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-25293 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Imran Emu TC Testimonials allows Stored XSS. This issue affects TC Testimonials: from n/a through 1.1.1.
History
Type Values Removed Values Added
Description Unrestricted Upload of File with Dangerous Type vulnerability in Imran Emu Portfolio Manager Pro otw-portfolio-manager allows Upload a Web Shell to a Web Server.This issue affects Portfolio Manager Pro: from n/a through 3.8. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Imran Emu TC Testimonials allows Stored XSS. This issue affects TC Testimonials: from n/a through 1.1.1.
Title WordPress Portfolio Manager Pro Plugin 3.8 - Arbitrary File Upload Vulnerability WordPress TC Testimonials plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Imran Emu TC Testimonials allows Stored XSS. This issue affects TC Testimonials: from n/a through 1.1.1. Unrestricted Upload of File with Dangerous Type vulnerability in Imran Emu Portfolio Manager Pro otw-portfolio-manager allows Upload a Web Shell to a Web Server.This issue affects Portfolio Manager Pro: from n/a through 3.8.
Title WordPress TC Testimonials plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability WordPress Portfolio Manager Pro Plugin 3.8 - Arbitrary File Upload Vulnerability
Weaknesses CWE-434
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}

 cvssV3_1

{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'}
Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Vendors & Products Wordpress
Wordpress wordpress
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Imran Emu TC Testimonials allows Stored XSS. This issue affects TC Testimonials: from n/a through 1.1.1.
Title WordPress TC Testimonials plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}
Earlier changes (2)
Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Sources

Status
PUBLISHED
Assigner
Patchstack
Published
Updated
Apr 28, 2026, 4:13 PM
Reserved
Jun 4, 2025, 3:44 PM

View source JSON

Updated
Aug 20, 2025, 1:44 PM

JSON

Status
Deferred
Published
Aug 20, 2025, 8:15 AM
Modified
Jun 17, 2026, 9:31 AM

View source JSON

No data.

Updated
May 1, 2026, 6:45 AM

JSON