Threats tagged 'ghsa-pmvw-96hq-2x7q'

The Real Testimonials WordPress plugin versions up to and including 4.1.0 are vulnerable to stored cross-site scripting (XSS) via the 'tpro_client_image' and 'tpro_client_testimonial' parameters. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires an administrator to have a display block configured with the 'Strip All HTML Tags' option disabled and to approve the injected testimonials, which is the default plugin setting.