CVE-2024-43959: Testimonials Plugin XSS Vulnerability

CVE-2024-43959 Overview

CVE-2024-43959 is a reflected Cross-Site Scripting (XSS) vulnerability in the Themepoints Super Testimonial WordPress plugin. The flaw stems from improper neutralization of user input during web page generation [CWE-79]. It affects all plugin versions up to and including 4.0.1. An attacker can craft a malicious URL that, when clicked by a victim, executes arbitrary JavaScript in the victim's browser session.

Critical Impact

Successful exploitation lets attackers run arbitrary scripts in the context of a victim's authenticated WordPress session, enabling session hijacking, credential theft, or unauthorized actions against the WordPress site.

Affected Products

• Themepoints Super Testimonial (Testimonials) WordPress plugin
• All versions from initial release through 4.0.1
• WordPress sites running the vulnerable plugin with public-facing endpoints

Discovery Timeline

• 2024-09-25 - CVE-2024-43959 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2024-43959

Vulnerability Analysis

The Super Testimonial plugin fails to sanitize and escape user-supplied input before reflecting it back into rendered HTML output. This results in a reflected XSS condition classified under [CWE-79]. An attacker crafts a URL containing a malicious payload in a request parameter handled by the plugin. When a victim follows the link, the server returns a response that includes the unsanitized payload inside the page body, causing the browser to execute the injected script.

The vulnerability requires user interaction, since the victim must click a malicious link or visit an attacker-controlled page that triggers the request. However, no authentication is required to deliver the payload. Because the script runs in the victim's browser under the target site's origin, it can read cookies that lack HttpOnly, manipulate the DOM, and issue authenticated requests on behalf of administrators if they are the ones tricked into following the link.

The EPSS score for this vulnerability is 0.512% with a percentile of 66.798, reflecting moderate observed exploitation interest for a reflected XSS in a WordPress plugin.

Root Cause

The plugin reads request parameters and writes them into HTML responses without applying WordPress escaping functions such as esc_html(), esc_attr(), or wp_kses(). The missing output encoding allows browser-interpretable characters such as <, >, and " to break out of their intended context.

Attack Vector

The attack is delivered over the network. The attacker constructs a URL targeting the vulnerable endpoint exposed by the Super Testimonial plugin, embeds a JavaScript payload in a reflected parameter, and distributes the link through phishing, comments, or third-party sites. When the victim loads the URL in an authenticated session, the payload executes within the WordPress origin. Refer to the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2024-43959

Indicators of Compromise

• HTTP GET requests to Super Testimonial plugin endpoints containing URL-encoded <script>, onerror=, onload=, or javascript: strings in query parameters.
• Web server access logs showing referer headers from external phishing or social media domains preceding requests to plugin URLs.
• Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after visiting plugin-rendered pages.

Detection Strategies

• Inspect web application firewall (WAF) logs for reflected XSS signatures targeting WordPress plugin parameters.
• Correlate WordPress access logs with browser-side Content Security Policy (CSP) violation reports to identify injected script execution.
• Hunt for administrator account activity originating from unusual IP addresses or user agents immediately after clicks on external links.

Monitoring Recommendations

• Enable verbose logging on the WordPress site and forward request logs to a centralized analytics platform for query-string inspection.
• Deploy CSP in report-only mode initially to surface reflected script execution without breaking legitimate functionality.
• Monitor plugin directories for unauthorized file modifications that may indicate post-XSS privilege escalation.

How to Mitigate CVE-2024-43959

Immediate Actions Required

• Identify all WordPress installations running the Themepoints Super Testimonial plugin at version 4.0.1 or earlier.
• Disable the plugin until a patched version is installed if active exploitation is suspected.
• Force administrator session invalidation and rotate authentication cookies on affected sites.
• Review WordPress user accounts for unauthorized additions or role changes.

Patch Information

At the time of publication, the vendor advisory tracked on Patchstack lists all versions through 4.0.1 as affected. Site administrators should upgrade to the latest available release of the Super Testimonial plugin from the WordPress.org plugin repository and verify the installed version after upgrade. Consult the Patchstack Vulnerability Report for vendor-published fix details.

Workarounds

• Deploy a WAF rule that blocks requests to Super Testimonial plugin endpoints containing script-tag patterns or common XSS payload markers.
• Apply a strict CSP that disallows inline scripts and restricts script sources to trusted domains.
• Restrict administrative access to the WordPress dashboard by IP address to reduce the impact of session hijacking via reflected XSS.
• Train administrators to avoid clicking unsolicited links to the site, especially from email or social media.

# Example WAF rule (ModSecurity) blocking script payloads to plugin endpoints
SecRule REQUEST_URI "@contains /wp-content/plugins/super-testimonial/" \
  "id:1004391,phase:2,deny,status:403,log,\
   chain,msg:'Blocked reflected XSS attempt against Super Testimonial plugin'"
  SecRule ARGS "@rx (?i)(<script|onerror=|onload=|javascript:)" "t:urlDecodeUni,t:lowercase"