The Testimonial Post type plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) via the 'auto_play' parameter. This occurs because the plugin does not properly sanitize or escape input before rendering it in web pages. As a result, authenticated users with Contributor or higher privileges can inject malicious scripts that execute in the context of other users viewing the injected pages. This vulnerability can lead to limited confidentiality and integrity impacts but does not affect availability. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, and requiring privileges but no user interaction.

Successful exploitation allows an authenticated user with Contributor-level access or above to inject persistent malicious scripts into pages generated by the plugin. These scripts execute in the browsers of users who view the affected pages, potentially leading to theft of session tokens, user impersonation, or other actions limited to the scope of the injected script. The impact is limited to confidentiality and integrity with no direct availability impact. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access carefully and consider disabling or removing the vulnerable plugin if possible. Monitor for updates from the vendor or plugin author regarding patches or mitigations.