The Testimonial Carousel For Elementor WordPress plugin suffers from a stored cross-site scripting vulnerability due to improper neutralization of input during web page generation. Specifically, the 'show_line_text' and 'slide_button_hover_animation' parameters are not properly sanitized or escaped, allowing authenticated users with contributor-level or higher permissions to inject arbitrary JavaScript code. This code executes in the context of any user who views the compromised page, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all versions up to and including 10.1.1. There is no vendor advisory or patch information available at this time.

Successful exploitation allows authenticated users with contributor-level permissions or higher to inject persistent malicious scripts into pages. These scripts execute in the browsers of users who visit the affected pages, potentially leading to information disclosure or session hijacking. The vulnerability does not impact availability and requires authentication, but it compromises confidentiality and integrity to a limited extent.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level permissions to trusted users only and consider disabling or removing the vulnerable plugin. Monitor for updates from the plugin vendor or WordPress security channels for an official patch or mitigation.