Stored Cross-Site Scripting Vulnerability in Client Testimonial Slider Plugin for WordPress

CVE-2025-13897

What is CVE-2025-13897?

The Client Testimonial Slider plugin for WordPress contains a vulnerability that allows authenticated users with Contributor-level access or higher to exploit a stored cross-site scripting (XSS). This vulnerability arises from inadequate input sanitization and insufficient output escaping of user-supplied attributes in the 'aft_testimonial_meta_name' custom field within the Client Information metabox. Attackers can inject malicious scripts into the administrative pages, leading to potential web application exploits whenever the page is accessed by other users.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References