The Fancy Testimonials plugin for WordPress contains a stored XSS flaw that is triggered by the 'author' shortcode attribute. Because the input is not sanitised or escaped, an attacker who can contribute content can embed malicious JavaScript that is stored and later rendered on pages that display the testimonial. When a victim visits the page, the script runs in the victim's browser, potentially stealing cookies, hijacking sessions, or performing other client‑side attacks. The vulnerability does not grant server‑side code execution or direct database access, but it can lead to phishing, defacement, or credential theft.

WordPress sites that have the dijitul Fancy Testimonials plugin installed and use a version up to and including 1.0. The flaw applies to all installations of those versions, regardless of WordPress theme or configuration.

The CVSS score of 6.4 indicates moderate impact, and the EPSS score of less than 1% suggests a low likelihood of exploitation at this time. The flaw is not listed in CISA’s KEV catalog. Attackers need a Contributor‑level account or higher within WordPress to inject the payload, and they must be able to add or edit a testimonial via the plugin’s interface. Once the malicious content is stored, any unauthenticated visitor who views the page will be exposed to the injected script, so the risk is amplified by the wide reach of the affected pages.