The Awesome Testimonials plugin for WordPress contains a CSRF flaw that allows an attacker to inject malicious JavaScript into testimonial data. When a forged request is processed, the attacker can store arbitrary script that is later rendered to site visitors, enabling execution of client‑side code when the testimonial is viewed.

The vulnerability affects the Prakash Awesome Testimonials plugin for WordPress for all versions up to and including 2.2.1. No other vendors or products are listed as affected.

The CVSS score of 7.1 classifies this as a high‑severity flaw, yet the EPSS score of <1% suggests a low probability that an exploit is currently in the wild. The vulnerability is not currently listed in CISA’s KEV catalog. The CVE description indicates that a forged request can cause malicious script to be stored and subsequently rendered to visitors, resulting in client‑side code execution. The exact target endpoint is not specified, but the flaw is a web‑based CSRF that can lead to stored XSS.