Stored Cross-Site Scripting Vulnerability in Real Testimonials Plugin for WordPress
CVE-2026-120685

5.4MEDIUM

Key Information:

Vendor

WordPress
Status
Real Testimonials – Testimonial Slider, Collect Customer Reviews And Video Testimonials
Vendor
CVE Published:
7 November 2026

What is CVE-2026-120685?

The Real Testimonials plugin for WordPress is susceptible to a Stored Cross-Site Scripting flaw, which arises from inadequate sanitization and escaping of user inputs. Attackers can exploit this vulnerability through the 'tpro_client_image' and 'tpro_client_testimonial' parameters to inject malicious scripts. This risk is heightened if the administrator has configured the display block without the 'Strip All HTML Tags' option activated, allowing injected scripts to execute whenever a user visits the affected page. Proper configuration and prompt updates are essential to safeguard against such exploits.

Affected Version(s)

Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials 0 <= 4.1.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/testimonial-fr...
https://plugins.trac.wordpress.org/browser/testimonial-fr...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

UKO
.