CVE-2026-120509

Name of the Vulnerable Software and Affected Versions Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials versions prior to 4.1.1

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server. The issue exists via the tpro client name parameter. Exploitation occurs when an administrator publishes a submitted testimonial, triggers the Show Preview AJAX handler, and saves an Update, which persists the payload as the Manage View title. This process requires administrative action to execute the injected scripts on pages accessed by users.

Recommendations Update Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials to version 4.1.1 or later. Avoid using the tpro client name parameter for submitting testimonials until the update is applied.