The Client Testimonial Slider plugin for WordPress contains an insufficiently sanitized and unescaped input field, allowing an attacker who has Administrator or higher privileges to embed arbitrary scripts into the Testimonial Heading setting. These scripts are stored and subsequently rendered on any page that displays the testimonial, resulting in a classic stored XSS. The malicious code runs in the context of users who view the affected page, potentially stealing cookies, defacing the site, or performing other client‑side attacks. The weakness is classified as CWE‑79. No escalation beyond the authenticated user’s privileges is required, making the risk limited to those who can edit testimonials. Affected systems include any WordPress installation running the Client Testimonial Slider plugin version 2.0 or earlier. The vendor name is recognized as amu02aftab and the plugin is affected only on multi‑site environments or when the unfiltered_html option is disabled. Users of older releases should verify that they are not running a vulnerable version and that their site configuration matches these conditions. Risk and exploitability are moderate from a CVSS perspective with a score of 4.4. The EPSS score is below 1% and the vulnerability is not currently listed in the CISA KEV catalog, indicating a low to moderate likelihood of exploitation in the wild. Attackers would need to possess Administrator or higher credentials on a multi‑site WordPress site, but the impact of a successful injection could be widespread within that site.

WordPress sites that have the Client Testimonial Slider plugin installed at version 2.0 or earlier. The primary affected product is the amu02aftab implementation of Client Testimonial Slider, particularly on multi‑site configurations or where the unfiltered_html capability is disabled.

The vulnerability carries a CVSS score of 4.4, indicating moderate severity. EPSS is <1%, showing that exploitation is currently rare. The vulnerability is not on the CISA KEV list, so there are no known active supply‑chain attacks targeting it. The attack vector requires administrative credentials and a WordPress multi‑site or unfiltered_html disabled setup, but with those conditions the attacker can embed arbitrary client‑side scripts that run for any site visitor.