PT-2025-43715 · Elementor +1 · Elementor +1

D.Sim · Published 2025-10-25 · Updated 2025-10-25 · CVE-2025-8666

Positive Technologies · (AI Summary)

CVSS v3.1

6.4

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Testimonial Carousel For Elementor plugin for WordPress versions prior to 11.6.3

Description The Testimonial Carousel For Elementor plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping. This allows authenticated attackers with contributor-level access or higher to inject malicious web scripts into pages. These scripts will then execute whenever a user accesses the compromised page. The issue affects multiple parameters.

Recommendations Update the Testimonial Carousel For Elementor plugin to version 11.6.3 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-8666

Affected Products

Elementor

Testimonial Carousel For Elementor

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-8666 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/1f5c3b2c-1ed2-47e1-8e39-cbe6f2973d15?source=cve · Note
• https://plugins.trac.wordpress.org/browser/testimonials-carousel-elementor/tags/11.6.2/widgets/animated-carousel/class-testimonialscarousel-cube.php#L913 · Note
• https://plugins.trac.wordpress.org/browser/testimonials-carousel-elementor/tags/11.6.2/widgets/animated-carousel/class-testimonialscarousel-coverflow.php#L1443 · Note
• https://plugins.trac.wordpress.org/browser/testimonials-carousel-elementor/tags/11.6.2/widgets/animated-carousel/class-testimonialscarousel-coverflow.php#L1425 · Note
• https://twitter.com/VulmonFeeds/status/1981970880528822378 · Twitter Post
• https://plugins.trac.wordpress.org/browser/testimonials-carousel-elementor/tags/11.6.2/widgets/testimonials-carousel/class-testimonialscarousel-blog.php#L1192 · Note
• https://plugins.trac.wordpress.org/browser/testimonials-carousel-elementor/tags/11.6.2/widgets/section-with-carousel/class-section-with-cube.php#L1167 · Note
• https://t.me/CVEtracker/35736 · Telegram Post
• https://twitter.com/CVEnew/status/1981959758371258748 · Twitter Post