CVE-2025-8666 Overview
CVE-2025-8666 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Testimonial Carousel For Elementor plugin for WordPress. The flaw affects all versions up to and including 11.6.2. Attackers with contributor-level access or higher can inject arbitrary JavaScript through multiple plugin parameters. The injected scripts execute in the browser of any user who views an affected page. The vulnerability stems from insufficient input sanitization and output escaping in several widget components.
Critical Impact
Authenticated contributors can plant persistent JavaScript payloads that execute in administrators' browsers, enabling session theft, privilege escalation, or site defacement.
Affected Products
- Testimonial Carousel For Elementor plugin for WordPress, versions <= 11.6.2
- Coverflow, Cube, Section-with-Cube, and Blog carousel widgets within the plugin
- WordPress sites running Elementor with the vulnerable plugin installed
Discovery Timeline
- 2025-10-25 - CVE-2025-8666 published to NVD
- 2026-10-08 - Last updated in NVD database
Technical Details for CVE-2025-8666
Vulnerability Analysis
The vulnerability is a stored Cross-Site Scripting flaw affecting multiple widget files in the Testimonial Carousel For Elementor plugin. User-controlled parameters are rendered into page output without proper escaping. An authenticated attacker with contributor-level permissions can supply JavaScript payloads through plugin widget settings. Those payloads are persisted in the WordPress database and served to every subsequent visitor of the affected page.
Because execution occurs in the context of the victim's browser session, an attacker can hijack administrator sessions, perform actions on behalf of logged-in users, or redirect visitors to attacker-controlled infrastructure. The CWE-79 classification confirms the issue is a classic failure to neutralize input during web page generation.
Root Cause
The root cause is the absence of proper sanitization on input and escaping on output in several widget rendering functions. Vulnerable code paths exist in class-testimonialscarousel-coverflow.php (lines 1425 and 1443), class-testimonialscarousel-cube.php (line 913), class-section-with-cube.php (line 1167), and class-testimonialscarousel-blog.php (line 1192). Values supplied through widget parameters are written directly into HTML attributes or markup without esc_attr(), esc_html(), or wp_kses() wrapping.
Attack Vector
The attack requires a valid WordPress account with contributor privileges or higher. The attacker edits a page or post, inserts one of the plugin's carousel widgets, and places a JavaScript payload into one of the vulnerable parameter fields. The payload is stored in the database. When any user — including administrators — views the published or previewed page, the script executes in their browser with the privileges of their active session. See the Wordfence Vulnerability Report for technical references to the vulnerable code paths.
Detection Methods for CVE-2025-8666
Indicators of Compromise
- WordPress posts or postmeta records containing <script>, onerror=, onload=, or javascript: strings associated with the Testimonial Carousel widget.
- Unexpected outbound requests from administrator browsers to unknown domains after loading pages that embed testimonial carousel widgets.
- New or modified administrator accounts created shortly after a contributor edited a page containing the carousel widget.
Detection Strategies
- Audit the wp_posts and wp_postmeta tables for Elementor widget JSON blobs referencing testimonial carousel widgets with suspicious script content.
- Review WordPress audit logs for contributor-level users editing pages that embed Testimonial Carousel For Elementor widgets.
- Deploy Content Security Policy (CSP) reporting to surface inline script execution originating from testimonial widget containers.
Monitoring Recommendations
- Monitor administrator session activity for anomalies such as unusual plugin installations, user role changes, or configuration edits following page views.
- Track plugin version inventory across WordPress deployments and alert on sites still running testimonials-carousel-elementor at version 11.6.2 or below.
- Correlate web application firewall logs for XSS payload patterns targeting Elementor widget save endpoints.
How to Mitigate CVE-2025-8666
Immediate Actions Required
- Update the Testimonial Carousel For Elementor plugin to a version later than 11.6.2 as soon as a patched release is available from the vendor.
- Review the WordPress user list and restrict contributor and higher privileges to trusted accounts only.
- Scan existing pages and widget configurations for stored script payloads and remove any malicious content.
Patch Information
The vulnerability affects versions up to and including 11.6.2. Site administrators should consult the Wordfence Vulnerability Report and the WordPress plugin repository for the latest fixed release. Apply the update across all WordPress environments including staging and development sites.
Workarounds
- Temporarily deactivate the Testimonial Carousel For Elementor plugin until a patched version is installed.
- Restrict the contributor role from accessing pages that use the plugin by adjusting role capabilities with a trusted access control plugin.
- Deploy a web application firewall rule that blocks requests containing JavaScript event handlers in Elementor widget save payloads.
# Identify vulnerable plugin installations via WP-CLI
wp plugin get testimonials-carousel-elementor --field=version
wp plugin deactivate testimonials-carousel-elementor
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.