CVE-2021-24598: 
WordPress vulnerability analysis and mitigation

The Testimonial WordPress plugin before version 1.6.0 contains a stored Cross-Site Scripting (XSS) vulnerability identified as CVE-2021-24598. The vulnerability was discovered by Asif Nawaz Minhas and publicly disclosed on October 13, 2021. This security issue affects the Testimonial Builder WordPress plugin, specifically versions prior to 1.6.0 (WPScan).

The vulnerability stems from improper escaping of testimonial fields in the plugin, which could allow high-privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. The vulnerability has been classified as CWE-79 and has received a CVSS v3.1 score of 4.8 (MEDIUM) (NVD).

When exploited, this vulnerability allows high-privilege users to inject malicious scripts into testimonial fields. These scripts would then be executed in the context of other users' browsers when they view the affected testimonials, potentially leading to unauthorized actions or data theft (WPScan).

The vulnerability has been fixed in version 1.6.0 of the Testimonial Builder plugin. Users are advised to update to this version or later to mitigate the security risk (WordPress Plugins).