Testimonials (Free < 2.7, Pro < 1.0.8) - Admin+ Stored Cross-Site Scripting

Create new Testimonial, add the following payload to either Position or Testimonial Text field: "></textarea><img src onerror=alert(/XSS/)>

Publish it, the payload will be triggered in the backend (in the Testimonial list, and when editing the related testimonial), and in page/posts where the shortcode is embed