CVE-2024-4193 is a stored cross-site scripting vulnerability in the Testimonial Slider WordPress plugin by davidanderson. The issue exists in all versions up to and including 1.3.2 and is due to improper neutralization of input in the 'testimonialcategory' shortcode. Authenticated users with contributor or higher privileges can inject arbitrary scripts that execute in the context of users viewing the affected pages. This vulnerability can lead to limited confidentiality and integrity impacts but does not affect availability. No known exploits in the wild have been reported, and no patch or vendor advisory is currently provided.

An attacker with contributor-level access or higher can inject malicious scripts that execute in the browsers of users viewing the affected pages. This can lead to limited confidentiality and integrity impacts, such as session hijacking or content manipulation. There is no indication of availability impact. The vulnerability requires authentication and privileges, limiting the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the Testimonial Slider plugin if possible. Monitor for updates from the vendor regarding patches or official mitigations.