Stored Cross-Site Scripting Vulnerability in Real Testimonials Plugin by WordPress
CVE-2026-120683

5.4MEDIUM

Key Information:

Vendor

WordPress
Status
Real Testimonials – Testimonial Slider, Collect Customer Reviews And Video Testimonials
Vendor
CVE Published:
7 November 2026

What is CVE-2026-120683?

The Real Testimonials plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability, which arises from inadequate input sanitization and output escaping. The issue resides in the 'tpro_client_testimonial' parameter, allowing unauthenticated users to inject malicious scripts into web pages that can execute when accessed by unsuspecting users. The exploitation process necessitates that an administrator approves the malicious testimonial, and the affected page must load the WordPress Interactivity runtime, potentially leading to significant security risks if not addressed.

Affected Version(s)

Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials 0 <= 4.1.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/testimonial-fr...
https://plugins.trac.wordpress.org/browser/testimonial-fr...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mohamed Amgad Khater (mamgad)
.