WP Projects Portfolio with Client Testimonials WordPress Plugin Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in the WP Projects Portfolio with Client Testimonials WordPress plugin, affecting versions through 3.0. The issue arises from the plugin's lack of proper cross-site request forgery (CSRF) checks in certain areas, combined with inadequate data sanitization and escaping. This vulnerability could enable attackers to exploit logged-in administrators by injecting malicious scripts that are then stored and executed.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.