CVE-2025-8666 – This stored XSS vulnerability in the Testimonia... (How to Fix)

Q: What is the severity of CVE-2025-8666?

CVE-2025-8666 has a CVSS score of 6.4 (MEDIUM). This stored XSS vulnerability in the Testimonial Carousel For Elementor WordPress plugin allows authenticated attackers with contributor-level access or higher to inject malicious scripts into website pages. These scripts execute automatically when users visit the compromised pages, potentially stealing credentials, session tokens, or performing unauthorized actions. All WordPress sites using vulnerable plugin versions are affected.

📋 TL;DR

This stored XSS vulnerability in the Testimonial Carousel For Elementor WordPress plugin allows authenticated attackers with contributor-level access or higher to inject malicious scripts into website pages. These scripts execute automatically when users visit the compromised pages, potentially stealing credentials, session tokens, or performing unauthorized actions. All WordPress sites using vulnerable plugin versions are affected.

💻 Affected Systems

Products:

Testimonial Carousel For Elementor WordPress plugin

Versions: All versions ≤ 11.6.2

Operating Systems: Any OS running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Requires authenticated user with contributor role or higher; affects all WordPress installations using vulnerable plugin versions.

⚠️ Manual Verification Required

This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.

Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).

🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.

Recommended Actions:

Review the CVE details at NVD
Check vendor security advisories for your specific version
Test if the vulnerability is exploitable in your environment
Consider updating to the latest version as a precaution

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could steal administrator credentials, hijack user sessions, deface websites, redirect visitors to malicious sites, or install backdoors for persistent access.

🟠

Likely Case

Attackers with contributor accounts inject malicious scripts to steal user session cookies or credentials, potentially gaining administrative access to the WordPress site.

🟢

If Mitigated

With proper user access controls and content security policies, impact is limited to data exfiltration from users visiting compromised pages.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires authenticated access; multiple vulnerable parameters exist across different plugin components.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Version > 11.6.2

Vendor Advisory: https://wordpress.org/plugins/testimonials-carousel-elementor/

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Testimonial Carousel For Elementor'. 4. Click 'Update Now' if available. 5. If no update appears, manually download latest version from WordPress.org and replace plugin files.

🔧 Temporary Workarounds

Restrict User Roles

all

Limit contributor and author role assignments to trusted users only

Implement Content Security Policy

all

Add CSP headers to restrict script execution sources

Add to .htaccess: Header set Content-Security-Policy "default-src 'self'; script-src 'self'"
Or use WordPress security plugins to implement CSP

🧯 If You Can't Patch

Disable or remove the Testimonial Carousel For Elementor plugin entirely
Implement strict user access controls and audit all contributor-level accounts

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin → Plugins → Testimonial Carousel For Elementor → Version number. If version ≤ 11.6.2, you are vulnerable.

Check Version:

wp plugin list --name=testimonials-carousel-elementor --field=version

Verify Fix Applied:

After updating, verify plugin version is > 11.6.2 in WordPress admin panel.

📡 Detection & Monitoring

Log Indicators:

Unusual POST requests to testimonial-related endpoints
Multiple failed login attempts followed by successful contributor login
Suspicious script tags in testimonial content

Network Indicators:

Outbound connections to unknown domains from your WordPress site
Unexpected script loads from external sources

SIEM Query:

source="wordpress.log" AND ("testimonial" OR "carousel") AND ("<script>" OR "javascript:" OR "onload=" OR "onerror=")

📊 Metadata

CVE ID: CVE-2025-8666

CVSS v3 Score: 6.4 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

CWE: CWE-79

EPSS Score: 0.05% exploit probability (16.7th percentile)

Published: October 25, 2025

Last Updated: October 27, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-8666, you might also want to check these: