CVE-2022-50947
WordPress Plugin Testimonial Slider and Showcase 2.2.6 Stored XSS
- State
- Published
- Severity
- 5.1 Medium
- Published
- May 10, 2026
- Updated
- May 24, 2026
- Reserved
- Jan 11, 2026
Description
WordPress Plugin Testimonial Slider and Showcase 2.2.6 contains a stored cross-site scripting vulnerability that allows authenticated editors to inject malicious scripts by failing to sanitize the post_title parameter. Attackers with editor privileges can inject JavaScript payloads through the testimonial title field that execute in the browsers of users viewing the draft post, enabling cookie theft and session hijacking.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.1 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N | VulnCheck |
| 3.1 | 6.4 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N | VulnCheck |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
Testimonial Slider and ShowcaseRadiusTheme |
|
References
- ExploitDB-51007exploit
- Official Product Homepageproduct
- Product Referenceproduct
- VulnCheck Advisory: WordPress Plugin Testimonial Slider and Showcase 2.2.6 Stored XSSthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.