The Real plugin contains a stored cross‑site scripting flaw that arises when an attacker supplies an unsanitized JPEG IPTC caption together with a [gallery] shortcode. Because the plugin does not escape or limit the content in these fields, an attacker can inject arbitrary JavaScript that is persisted and executed whenever a page containing the testimonial is viewed. This vulnerability is described as CWE‑79 and allows unauthenticated users to run scripts in the browsers of other site visitors, potentially leading to browser‑based attacks such as cookie theft, session hijacking or defacement.

The issue affects the Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials plugin from shapedplugin. All releases through version 4.1.0 are impacted.

The vulnerability has a CVSS score of 5.4, indicating moderate severity. The EPSS score is not available and the flaw is not listed in the CISA KEV catalog. An attacker does not need authentication to exploit the vulnerability; however, successful exploitation requires that the plugin’s Strip All HTML Tags setting remain disabled (the default for formatted content) and that the attacker’s testimonial be approved by an administrator. The attack vector likely involves uploading or editing a testimonial via the WordPress interface, making the flaw relatively easy to reach for any visitor that can submit testimonials.