Threats tagged 'ghsa-7rw2-9cq5-4p94'

The Real Testimonials WordPress plugin up to version 4.1.0 is vulnerable to stored cross-site scripting (XSS) via the 'tpro_client_name' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires an administrator to publish the testimonial, preview it via AJAX, and save an update, which stores the malicious payload. The attacker cannot trigger the vulnerability without administrator interaction.