Testimonial Free Vulnerabilities

The Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 3.1.15 via deserialization of untrusted input. This makes it possible for authenticated attackers, with administrator-level access and...

CVSS:

6.6

Affected:

up to 3.1.15

Fixed in:

3.1.16

Disclosed:

Jul 7, 2026

CVE-2026-59521 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShapedPlugin LLC Real Testimonials allows Stored XSS. This issue affects Real Testimonials: from n/a through 3.1.6.

Affected:

up to 3.1.7

Fixed in:

3.1.7

Disclosed:

Apr 15, 2025

CVE-2025-22269 on NVD →

The Real Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in page...

CVSS:

6.4

Affected:

up to 3.1.6

Fixed in:

3.1.7

Disclosed:

Apr 11, 2025

CVE-2025-22269 on NVD →

[en] The Real Testimonials WordPress plugin before 2.6.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such a...

Affected:

up to 2.6.0

Fixed in:

2.6.0

Disclosed:

Jan 16, 2023

CVE-2022-4648 on NVD →

The Real Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in versions up to, and including, 2.5.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor level permissions and above to injec...

CVSS:

6.4

Affected:

up to 2.5.11

Fixed in:

2.6.0

Disclosed:

Dec 22, 2022

CVE-2022-4648 on NVD →

Authenticated Stored Cross-Site Scripting (XSS) vulnerability discovered by Fortinet in WordPress Testimonial – Best Testimonial Slider plugin (versions <= 2.1.7).

Affected:

up to 2.2

Fixed in:

2.2

Disclosed:

Mar 2, 2020

The Real Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated low-privileged attackers to inject arbitrary web scripts in pages that will execute wheneve...

CVSS:

6.4

Affected:

up to 2.1.6

Fixed in:

2.2

Disclosed:

Feb 20, 2020

The Real Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated low-privileged attackers to inject arbitrary web scripts in pages that will execute wheneve...

Affected:

up to 2.2

Fixed in:

2.2

Disclosed:

Feb 20, 2020

A stored XSS vulnerability exists in the version of the plugin 2.1.6. Successful exploitation of this vulnerability would allow an authenticated low-privileged user to inject arbitrary javascript code into the plugin gallery image which is viewed by other users.

Affected:

up to 2.1.7

Fixed in:

2.1.7