The Real Testimonials plugin accepts user input through the 'tpro_client_testimonial' field without proper sanitization or escaping. This allows an unauthenticated attacker to embed malicious JavaScript that will be stored in the database and later rendered on any page that displays the testimonial content. When an end‑user views that page, or when the site loads the WordPress Interactivity runtime used by a theme or block, the injected script executes in the victim’s browser context. The injected code can hijack user sessions, exfiltrate data, or perform further client‑side attacks, compromising confidentiality and integrity of the site and its users.

WordPress installations running the Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials plugin version 4.1.0 or older are affected. The vulnerability exists in all releases up to and including 4.1.0 of the plugin and would impact any site that publishes testimonials via the plugin’s submission form.

The CVSS score of 5.4 indicates a moderate severity. No EPSS score is supplied, and the issue is not listed in CISA’s KEV catalog, suggesting that it has not yet seen widespread exploitation. The likely attack vector is through the public testimonial submission form: an attacker submits a crafted testimonial, an administrator later approves it, and the stored script is served to all site visitors. Successful exploitation therefore requires administrative approval of a pending testimonial and the presence of the WordPress Interactivity runtime on the target page. The attack can lead to cross‑site scripting for all users who view the infected testimonial, exposing them to credential theft or other client‑side damage.