A CSRF-to-XSS vulnerability in the Prakash Awesome Testimonials plugin allows unauthenticated attackers to execute malicious scripts in the context of an administrator session.

This vulnerability is caused by a lack of CSRF protection, which allows an unauthenticated attacker to trick an authenticated user into performing actions that lead to Stored XSS. The attack targets the plugin functionality, enabling the injection of arbitrary scripts that execute when a victim views the affected testimonials.

The ability to execute arbitrary JavaScript in an administrative session poses a severe risk to the integrity and security of the WordPress instance. An attacker could leverage this to create new administrative accounts, redirect users, or exfiltrate sensitive data, leading to a complete compromise of the site. The CVSS score of 8.8 reflects the high potential for unauthorized access and significant impact on the confidentiality, integrity, and availability of the application.

Immediate Action: Since a specific patch version is not currently identified, administrators should disable or uninstall the Awesome Testimonials plugin until a security update is released by the vendor.

Proactive Monitoring: Review web server and WordPress application logs for suspicious administrative actions or unauthorized changes to testimonial content.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block common CSRF and XSS patterns directed at the plugin endpoint.

Public Exploit Available: Unknown

Given the high CVSS score and the critical nature of Stored XSS vulnerabilities, immediate action is required to minimize the attack surface. Organizations using this plugin should prioritize deactivation until the vendor provides a version that includes verified CSRF protections. Failure to address this flaw could lead to full administrative compromise of the affected WordPress site.