title: Testimonials (Free < 2.7, Pro < 1.0.8) - Admin+ Stored Cross-Site Scripting
description: The Testimonials WordPress plugin before 2.7, super-testimonial-pro WordPress plugin before 1.0.8 do not sanitize and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
problem types: CWE-79 Cross-Site Scripting (XSS)
affected:
{
vendor: Unknown
product: Testimonials
versions:
version: 2.7, status: affected, lessThan: 2.7, versionType: custom
}
{
vendor: Unknown
product: Testimonial Pro
versions:
version: 1.0.8, status: affected, lessThan: 1.0.8, versionType: custom
}
