The Stars Testimonials plugin stores user input directly into the database without proper output encoding, allowing an attacker to inject malicious JavaScript that will be served to any site visitor. This stored XSS can lead to session hijacking, credential theft, defacement, or the execution of arbitrary code within the victim’s browser context. The weakness is a classic input validation failure corresponding to CWE‑79.

WordPress sites that have installed the Stars Testimonials plugin, any version up to and including 3.3.4. Updates to later releases remove the vulnerability and must be applied in all affected deployments.

The vulnerability has a CVSS score of 6.5, indicating moderate severity. Its EPSS score is below 1% and it is not listed in CISA’s KEV catalog, suggesting exploitation is currently rare but not impossible. An attacker would need to submit malicious content through the plugin’s comment or testimonial entry interface, typically requiring authenticated access or an exposed front‑end form that accepts user input.