Cross-Site Scripting Vulnerability in Testimonials Showcase Plugin by Cmoreira
CVE-2025-49245

7.1HIGH

Key Information:

Vendor

WordPress
Status
Testimonials Showcase
Vendor
CVE Published:
4 July 2025

What is CVE-2025-49245?

The Testimonials Showcase plugin by Cmoreira is vulnerable to a reflected Cross-Site Scripting (XSS) flaw. This vulnerability arises from improper neutralization of user inputs, allowing attackers to execute malicious scripts in the user's browser. Users of versions up to 1.9.16 are advised to review their security posture and apply necessary updates to mitigate potential exploitation risks.

Affected Version(s)

Testimonials Showcase <= 1.9.16

References

https://patchstack.com/database/wordpress/plugin/testimon...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) (Patchstack Alliance)
.
CVE-2025-49245 : Cross-Site Scripting Vulnerability in Testimonials Showcase Plugin by Cmoreira