The Real Testimonials – Testimonial Slider plugin for WordPress allows stored cross‑site scripting through the 'tpro_client_name' field when a testimonial is submitted. An attacker can inject arbitrary JavaScript that is persisted as the title of the testimonial during the moderation workflow. Once the affected testimonial is approved and displayed, the payload executes in the browsers of any visitor to the page, potentially enabling session hijacking, defacement, or cookie theft. The vulnerability arises from insufficient input validation and lack of output escaping, a classic input‑validation weakness described by CWE‑79.

WordPress sites running the Real Testimonials plugin up to and including version 4.1.0 are impacted. Site administrators using these versions should verify which version they have installed and plan an upgrade accordingly.

The CVSS score of 4.7 places the vulnerability in the low‑to‑medium severity range. Exploitation requires the attacker to submit a malicious testimonial and wait for an administrator to approve it, after which the AJAX Show Preview handler and a subsequent update persist the payload. No publicly available exploit code is known, and the vulnerability is not listed in the CISA KEV catalog. However, because the attack vector is user‑friendly (simple form submission) and carries the danger of cross‑site script execution, the risk remains tangible for sites that permit open testimonial submission without strong access controls.