The plugin does not escape testimonial content and reverses WordPress’s built‑in HTML sanitization, so a user with Author or higher level can embed JavaScript that runs in the browser of any site visitor. An attacker can then steal session data, deface the site, or execute arbitrary actions as the authenticated user who views the testimonial, including administrators.

WordPress sites running the WP Testimonials plugin version 1.4.13 or earlier. Any installation where testinomial submissions are allowed for users with Author role or higher is susceptible.

The flaw is a stored XSS that requires legitimate author access to inject payloads. While the EPSS score is not available and the vulnerability is not in the CISA KEV list, the ability to run code in an administrator’s session makes the potential impact severe. No public exploit code is referenced, but attackers could manually submit malicious testimonials through the normal plugin interface.