The Super Testimonials plugin for WordPress, a popular tool for showcasing client feedback, was found to have a serious security flaw. This vulnerability, known as Stored Cross-Site Scripting (XSS), could allow malicious code to be injected into your website. This means that an attacker could potentially run their own scripts on your site, affecting visitors who view the compromised pages.
This issue specifically stemmed from how the plugin handled user input in the ‘st_user_title’ parameter. Prior to the fix, the plugin wasn’t carefully checking or “sanitizing” the data entered by users, nor was it properly “escaping” that data when it was displayed on the website. This oversight created an opening for attackers to slip in harmful web scripts.
These scripts could then execute in the browsers of your website visitors. This could lead to various problems, from defacing your website to stealing sensitive user information like cookies or session tokens.
CVE Details
- Product: Super Testimonials plugin for WordPress
- CVE ID: CVE-2024-13704
- Published Date: February 18, 2025
- Severity: HIGH
- Status: Analyzed
Affected Products
The Stored Cross-Site Scripting vulnerability impacts all versions of the Super Testimonials plugin for WordPress up to, and including, 4.0.1. If you are running any version within this range, your website is potentially at risk.
Current Status
This vulnerability has been officially analyzed and confirmed.
Severity Level
The Common Vulnerability Scoring System (CVSS) rates CVE-2024-13704 with a score of 7.2, categorizing it as a HIGH severity vulnerability. A high severity rating indicates that the vulnerability is easy to exploit and could have significant consequences, such as compromising user data or defacing your website, without requiring complex attack methods.
Possible Solutions
The good news is that a fix for this vulnerability is available. Developers of the Super Testimonials plugin addressed this issue in version 4.0.2, which was released on February 13, 2025.
To protect your WordPress website and its visitors, it is crucial to update your Super Testimonials plugin to version 4.0.2 or later immediately. This update includes necessary input sanitization and output escaping measures to prevent Stored Cross-Site Scripting attacks. Always ensure your plugins are kept up-to-date to benefit from the latest security patches and enhancements.
References
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3240039%40super-testimonial&new=3240039%40super-testimonial&sfp_email=&sfph_mail=
https://www.wordfence.com/threat-intel/vulnerabilities/id/20720912-6bfd-4df1-97c7-7025c16d7a0f?source=cve
