CVE-2026-120685

Name of the Vulnerable Software and Affected Versions Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials versions prior to 4.1.1

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts through the tpro client image (JPEG IPTC caption) + tpro client testimonial ([gallery] shortcode) parameter. These scripts execute when a user accesses the affected page. Exploitation requires an administrator to have approved the submitted testimonials and to have the display block configured with the Strip All HTML Tags option disabled, which is the default setting for rendering formatted content.

Recommendations Update the plugin to version 4.1.1 or later. Enable the Strip All HTML Tags option in the display block configuration to prevent the execution of injected scripts.