Security Alert Summary
The Testimonials Creator plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in version 1.6. Due to insufficient input sanitization and output escaping in admin settings, authenticated users with administrator-level permissions can inject scripts that execute when an affected page is viewed. This issue specifically affects multisite installations and sites where unfiltered_html has been disabled.
CVE Details
- CVE ID:
CVE-2025-14379 - Affected component: Testimonials Creator plugin for WordPress
- Affected versions: version 1.6 (as stated in the CVE). Any fixed version is not specified in the CVE entry.
- Scope / install limitations: Only affects multisite installations and installations where
unfiltered_htmlhas been disabled (as stated in the CVE). - Published: January 14, 2026 at 6:15:52 AM
- Last modified: January 14, 2026 at 4:25:12 PM
- CVSS v3.1: Base Score 4.4, Severity: MEDIUM, Vector:
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N - Authentication / privileges / user interaction: Requires an authenticated attacker with administrator-level permissions (CVSS Privileges Required: HIGH). No user interaction required (UI: NONE).
- Primary impact: Confidentiality: LOW; Integrity: LOW; Availability: NONE
- CWE / weakness: CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting)
Technical Details
The vulnerability is a stored cross-site scripting (XSS) issue arising from insufficient input sanitization and missing output escaping in the plugin’s admin settings. An authenticated attacker with administrator-level permissions can save crafted input in the affected settings fields. Because the plugin does not properly sanitize or escape that stored data when it is rendered on pages, the injected scripts will execute in the context of any user who views an injected page.
The CVE description notes this occurs in version 1.6 and that the issue is limited to multisite installations and installations where unfiltered_html has been disabled. No specific functions or REST API endpoints are named in the CVE entry; the root cause is identified as inadequate input validation and output escaping for admin-configured content.
How This Could Impact Your Website
Consider a site with a site owner, internal staff who manage content, and an external contractor who assists with site administration. If an administrator or other privileged user with access to the plugin settings saves malicious input, that script could run when other users (including editors or site visitors) view the affected pages. Practical consequences include disclosure of session information or user-visible content manipulation consistent with the CVSS impacts (confidentiality and integrity impacts are rated as LOW).
Realistic outcomes include exposure of internal user data that is visible on affected pages and an increased risk of targeted phishing or social engineering against staff or contributors who visit those pages. The issue is constrained by the requirement for an authenticated administrator-level actor and the installation conditions described, but it nonetheless increases attack surface for privileged misuse.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available. (The CVE does not specify a fixed version.)
- Review and reduce unnecessary user roles and privileges, especially for contributors and administrators.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your installation.
- Monitor site activity and logs for unusual behavior related to plugin settings changes or unexpected content injections.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
