CVE-2020-26672: 
WordPress vulnerability analysis and mitigation

The Testimonial Rotator WordPress Plugin version 3.0.2 was identified with a Cross-Site Scripting (XSS) vulnerability, tracked as CVE-2020-26672. The vulnerability was discovered in 2020 and affects the plugin's functionality in the /wp-admin/post.php file. This security issue impacts WordPress installations using the affected plugin versions up to 3.0.2 (NVD, CVE Mitre).

The vulnerability is classified as an Authenticated Stored Cross-Site Scripting (XSS) issue, specifically in the 'Author Information' textarea within testimonials. The vulnerability allows authenticated users with medium-level privileges (contributor or higher) to inject arbitrary JavaScript through the 'cite' parameter. The CVSS v3.1 base score is 5.4 (Medium) with a vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (NVD, WPScan).

When exploited, the vulnerability allows injected malicious JavaScript to be stored in the database and subsequently executed when users visit public posts or the testimonial page listing in the backend. The payload is triggered for any user accessing these affected areas, potentially leading to unauthorized access to user data or session hijacking (WPScan).

The vulnerability requires an authenticated user with contributor-level privileges or higher to exploit. The attack vector involves intercepting a POST request to /wp-admin/post.php and inserting a malicious payload in the 'cite' parameter. The filter works through JavaScript, allowing the payload to bypass normal security measures and be stored in the database (WPScan).

The vulnerability was fixed in version 3.0.3 of the Testimonial Rotator plugin, released on June 16th, 2020. Users are strongly advised to update to this version or later to mitigate the security risk (WPScan).