WordPress plugin
Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 7 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High0
- Medium7
- Low0
All Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium4.7 | Unauthenticated Stored Cross-Site Scripting via 'tpro_client_name' Parameter ≤4.1.0Update to 4.1.1 | CVE-2026-120509 | |
| Medium5.4 | Unauthenticated Stored Cross-Site Scripting via Testimonial Submission Form 'tpro_client_testimonial' Parameter ≤4.1.0Update to 4.1.1 | CVE-2026-120683 | |
| Medium5.4 | Unauthenticated Stored Cross-Site Scripting via JPEG IPTC Caption + '[gallery]' Shortcode Chain ≤4.1.0Update to 4.1.1 | CVE-2026-120685 | |
| Medium6.6 | Authenticated (Administrator+) PHP Object Injection ≤3.1.15Update to 3.1.16 | CVE-2026-59521 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting ≤3.1.6Update to 3.1.7 | CVE-2025-22269 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross Site Scripting via Shortcode ≤2.5.11Update to 2.6.0 | CVE-2022-4648 | |
| Medium6.4 | Authenticated Stored Cross-Site Scripting ≤2.1.6Update to 2.2 | — |
- Medium4.7Unauthenticated Stored Cross-Site Scripting via 'tpro_client_name' Parameter
≤4.1.0Update to 4.1.1
- Medium5.4Unauthenticated Stored Cross-Site Scripting via Testimonial Submission Form 'tpro_client_testimonial' Parameter
≤4.1.0Update to 4.1.1
- Medium5.4Unauthenticated Stored Cross-Site Scripting via JPEG IPTC Caption + '[gallery]' Shortcode Chain
≤4.1.0Update to 4.1.1
- Medium6.6Authenticated (Administrator+) PHP Object Injection
≤3.1.15Update to 3.1.16
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.1.6Update to 3.1.7
- Medium6.4Authenticated (Contributor+) Stored Cross Site Scripting via Shortcode
≤2.5.11Update to 2.6.0
- Medium6.4Authenticated Stored Cross-Site Scripting
≤2.1.6Update to 2.2
Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials: common questions
Does Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials have known vulnerabilities?
Yes. VulnCrest Radar lists 7 known vulnerabilities in Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials: 7 medium. None are known to affect version null.
How do I check which version of Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials vulnerability?
CVE-2026-120509, published Nov 6, 2026: Real Testimonials <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting via 'tpro_client_name' Parameter. Severity: Medium (CVSS 4.7).
Is any Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials vulnerability listed in CISA KEV?
No. None of the known Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials vulnerabilities is currently listed in the CISA KEV catalog.