Reflected Cross-Site Scripting in Testimonial Master Plugin for WordPress

CVE-2025-14127

What is CVE-2025-14127?

The Testimonial Master plugin for WordPress is exposed to a Reflected Cross-Site Scripting flaw due to inadequate validation of user inputs via the $_SERVER['PHP_SELF'] variable. This vulnerability enables unauthenticated attackers to embed malicious scripts into web pages. If users can be convinced to interact with modified links, these scripts can execute in their browsers, potentially compromising user data or session information. All versions up to and including 0.2.1 are affected, underscoring the necessity for prompt updates to mitigate this risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References