The Super Testimonial – Testimonial & Customer Review Slider Plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-80) in the 'st_user_title' parameter. Due to insufficient sanitization and escaping, attackers can inject malicious scripts that persist and execute in the context of users visiting the injected pages. This vulnerability affects all versions up to 4.0.1 and requires no privileges or user interaction to exploit. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality and integrity with scope changed.

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of users visiting the affected pages, potentially leading to data theft, session hijacking, or other malicious actions impacting confidentiality and integrity. Availability is not affected. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the plugin if possible or applying manual input sanitization and output escaping as a temporary mitigation. Monitor official themepoints or WordPress plugin repositories for updates.