The Testimonial Post type plugin for WordPress allows an authenticated user with Contributor role or higher to store malicious scripts through the auto_play parameter. Because the plugin fails to sanitize or escape this input, the injected code is persisted and will execute in the browser whenever the affected page is viewed, leading to potential theft of session cookies, defacement, or other client‑side compromise. This is a classic stored XSS flaw (CWE‑79) that can be leveraged by any user who can create or edit testimonial posts.

The vulnerability is present in all releases of the Testimonial Post type plugin up to and including version 1.2.1; the vendor is identified as juiiee8487. Any WordPress site running a vulnerable version is affected; newer releases beyond 1.2.1 are not known to contain this issue.

The CVSS score of 6.4 indicates a moderate severity. The EPSS score of less than 1 % suggests a very low likelihood of exploitation at this time, and the defect is not listed in CISA’s KEV catalog. The attack vector is inferred to be via the WordPress administrative interface; an authenticated Contributor or higher user must submit a testimonial containing malicious script, after which any visitor to that testimonial will be exposed to the XSS effect. The impact is limited to browsers that render the injected content, and an attacker cannot elevate privileges or compromise the server directly.