The Testimonial Carousel For Elementor plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Authenticated attackers with contributor-level privileges or above can inject arbitrary web scripts through multiple parameters. These scripts persist in the affected pages and execute in the context of users who access those pages. The vulnerability impacts versions up to 11.6.2. No patch or official fix information is provided in the available data.

Successful exploitation allows an attacker with contributor-level access to inject persistent malicious scripts that execute in the browsers of users viewing the compromised pages. This can lead to information disclosure and integrity impacts as indicated by the CVSS vector (Confidentiality: Low, Integrity: Low, Availability: None). There is no indication of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider removing or disabling the vulnerable plugin to prevent exploitation.