CVE-2020-14959: 
WordPress vulnerability analysis and mitigation

Multiple XSS vulnerabilities were discovered in the Easy Testimonials WordPress plugin before version 3.6. The vulnerability was assigned CVE-2020-14959 and was disclosed on June 22, 2020. The affected parameters include wp-admin/post.php Client Name, Position, Web Address, Other, Location Reviewed, Product Reviewed, Item Reviewed, and Rating parameters on the admin login portal (AttackerKB).

The vulnerability allows remote attackers to inject arbitrary web script or HTML via multiple parameters in the wp-admin/post.php file. The affected parameters include Client Name, Position, Web Address, Other, Location Reviewed, Product Reviewed, Item Reviewed, and Rating. This cross-site scripting vulnerability requires authentication with contributor-level permissions or above to exploit (AttackerKB).

If successfully exploited, the vulnerability allows attackers to inject arbitrary web scripts that will execute whenever a user accesses an injected page. This could potentially lead to theft of sensitive data, session hijacking, or other malicious actions performed in the context of the affected user's browser (AttackerKB).

Users should upgrade to Easy Testimonials version 3.6 or later which contains fixes for these XSS vulnerabilities. If immediate upgrade is not possible, limiting access to contributor and higher level accounts can help reduce the risk of exploitation (AttackerKB).