CVE-2022-50947
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
Stored XSS in Testimonial Slider and Showcase plugin 2.2.6 for WordPress. Authenticated editors can inject malicious script via the post_title field, which executes for other users.
Risk Assessment
An attacker with editor privileges can steal cookies and hijack sessions of other users, including administrators.
Recommendation
Update the Testimonial Slider and Showcase plugin to the latest version.
Original NVD description (English source)
WordPress Plugin Testimonial Slider and Showcase 2.2.6 contains a stored cross-site scripting vulnerability that allows authenticated editors to inject malicious scripts by failing to sanitize the post_title parameter. Attackers with editor privileges can inject JavaScript payloads through the testimonial title field that execute in the browsers of users viewing the draft post, enabling cookie theft and session hijacking.