Stored Cross-Site Scripting in Real Testimonials Plugin for WordPress
CVE-2026-120509

4.7MEDIUM

Key Information:

Vendor

WordPress
Status
Real Testimonials – Testimonial Slider, Collect Customer Reviews And Video Testimonials
Vendor
CVE Published:
7 November 2026

What is CVE-2026-120509?

The Real Testimonials plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability through the 'tpro_client_name' parameter. This issue arises from inadequate input sanitization and output escaping in all versions up to and including 4.1.0. Unauthenticated attackers can inject arbitrary scripts that execute when users access affected pages. To exploit this vulnerability, an attacker must submit a testimonial that an administrator later publishes, thereby embedding malicious payloads into the platform through the standard moderation workflow.

Affected Version(s)

Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials 0 <= 4.1.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/testimonial-fr...
https://plugins.trac.wordpress.org/browser/testimonial-fr...

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

UKO
.