CVE-2026-120685

The Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tproclientimage JPEG IPTC caption + tproclienttestimonial gallery shortcode' parameter in all versions up to, and including, 4.1.0...

EUVD-2026-119153

The Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tproclientimage JPEG IPTC caption + tproclienttestimonial gallery shortcode' parameter in all versions up to, and including, 4.1.0...

CVE-2026-120685 Real Testimonials <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting via JPEG IPTC Caption + '[gallery]' Shortcode Chain

The Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tproclientimage JPEG IPTC caption + tproclienttestimonial gallery shortcode' parameter in all versions up to, and including, 4.1.0...

CVE-2026-120685

The Real Testimonials WordPress plugin (versions up to and including 4.1.0 ) is vulnerable to Unauthenticated Stored Cross-Site Scripting (XSS) . The flaw is caused by insufficient input sanitization and output escaping in the tpro_client_image (JPEG IPTC caption) and tpro_client_testimonial ([ga...