Testimonial Carousel Elementor CVE-2025-8666
MEDIUMSeverity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Contributor authentication is required so PR:L; stored payload executes in other users' browsers giving S:C with limited C/I and no availability impact.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
3DescriptionCVE.org
The Testimonial Carousel For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions less than, or equal to, 11.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored cross-site scripting in the Testimonial Carousel For Elementor WordPress plugin (versions through 11.6.2) allows an authenticated user with contributor-level privileges or higher to inject arbitrary JavaScript through multiple unsanitized carousel widget parameters, and that payload then executes in the browser of any administrator, editor, or site visitor who later views the injected page. Per the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, the privilege gate (PR:L) means unauthenticated attackers cannot exploit it directly, and exploitation additionally requires the plugin and its Elementor dependency to be installed and active. Exploitation signals are weak - EPSS is 0.25% (15th percentile), there is no CISA KEV listing, and no public exploit code identified at time of analysis - and the scope-changed but low confidentiality/integrity impact keeps this a moderate-severity, non-urgent issue.
Technical ContextAI
This is a classic CWE-79 stored (persistent) cross-site scripting flaw in a WordPress plugin that extends Elementor with testimonial carousel widgets. The root cause is insufficient input sanitization when widget settings are saved and insufficient output escaping when those settings are rendered back into the page markup; the vulnerable code paths are visible in the plugin source at tag 11.6.2, specifically the animated-carousel coverflow widget (class-testimonialscarousel-coverflow.php around lines 1425 and 1443), the animated-carousel cube widget (class-testimonialscarousel-cube.php around line 913), the section-with-carousel cube widget (class-section-with-cube.php around line 1167), and the testimonials-carousel blog widget (class-testimonialscarousel-blog.php around line 1192). Because the malicious content is persisted in the WordPress database as widget/post data rather than reflected back immediately, it survives across requests and detonates for every subsequent viewer. The CVSS scope change (S:C) reflects that the injected script runs in the security context of the affected site and can act on behalf of higher-privileged users who view the page, even though the attacker only holds contributor-level access; confidentiality and integrity impacts are rated Low (C:L/I:L) and availability is unaffected (A:N), which matches stored XSS that is not designed for full site takeover.
Affected ProductsAI
The vulnerability affects the WordPress plugin Testimonial Carousel For Elementor in all versions less than or equal to 11.6.2, as stated in the CVE description and reinforced by the referenced plugin source files under the 11.6.2 tag on plugins.trac.wordpress.org. Because the plugin renders through Elementor widgets, affected installations are WordPress sites running both Elementor and an unpatched Testimonial Carousel For Elementor build; the specific vulnerable widget classes are the animated carousel coverflow and cube widgets, the section-with-carousel cube widget, and the testimonials carousel blog widget. No CPE strings were supplied with the intelligence feed, so exact product/version identifiers must be confirmed against the vendor plugin page and the Wordfence threat-intelligence advisory (ID 1f5c3b2c-1ed2-47e1-8e39-cbe6f2973d15), which is the authoritative reference for the affected version range.
RemediationAI
No vendor-released patch version is identified in the available data; the supplied references point to the vulnerable 11.6.2 source on the WordPress plugin Trac rather than to a fixed release, so the first action is to check the WordPress plugin repository and the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/1f5c3b2c-1ed2-47e1-8e39-cbe6f2973d15?source=cve) for a version newer than 11.6.2 and update the plugin as soon as one is published, after validating that the patched build no longer emits unescaped widget parameters. Until then, effective compensating controls are: audit all accounts on the site and remove or downgrade any contributor-or-higher user who is not fully trusted (trade-off: this can disrupt legitimate multi-author editorial workflows), since the PR:L gate is the single biggest limiting factor; temporarily deactivate the Testimonial Carousel For Elementor plugin if carousels are not business-critical (trade-off: all existing carousel/section-with-carousel widgets stop rendering and may leave broken layout on published pages); and, if the plugin must stay live, deploy a web application firewall or WordPress security plugin rule set that blocks inline script and event-handler payloads in plugin widget parameters and admin-ajax/REST write paths (trade-off: generic XSS signatures can cause false positives on legitimate HTML in testimonial content), plus a Content-Security-Policy that forbids inline script execution for the front end (trade-off: CSP can break Elementor and third-party scripts and needs careful tuning).
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today