Elfsight Testimonials Slider
Elfsight Testimonials Slider has 3 disclosed vulnerabilities in the WordSec catalog, all reported in 2025; none of them are fixed as of September 2026. Their average CVSS score is 4.3, and the most serious one scores 4.4 out of 10. 2025 was the busiest year with 3 disclosures.
The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (33%). Other recurring categories include Cross-Site Scripting, Missing Authorization.
None of the 3 issues recorded for Elfsight Testimonials Slider have a published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.
All of these findings were reported by Pham Van Tam. Elfsight Testimonials Slider is installed on roughly 300 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.8.8.
CVE-2025-31587Elfsight Testimonials Slider <= 1.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records

Elfsight Testimonials Slider
Author
elfsight
Introduction Elfsight Testimonials Slider plugin is a simple and easy-to-use tool for those who want to display customers’ testimonials on the website in the most effective way. Just install it to any page of your website to show positive interaction with clients and improve your business credibility. Try live demo: https://elfsight.com/testimonials-slider-widget/ Increase your customer trust and strengthen your reputation, displaying reliable and trustworthy testimonials. Make positive user experiencу act as emotional persuading to increase conversion of your website. Benefits Make your testimonials really trustworthy by using names, photos, logos and links. Achieve better interaction with your clients showing real user experience of your product. Improve your conversion rate and attract new reviews by social proof of trust. Features Our Testimonials Slider plugin is extremely easy to install and it doesn’t require coding skills. Yet it’s reach in one-click-available features, which will help you in your business needs. A minimum set of fields to send a feedback: name, email, phone, and message Hide the fields you don’t like to show Set your own field labels Specify a placeholder for any field, for example to demonstrate the required format Choose the fields to make required 2 predefined layouts: inline to be added to the page body, and floating to follow your visitor’s scroll Order the fields in the form the way you like Horizontal layout is set automatically adjusting to the width of your form Works and looks perfectly on mobile devices Seamless design which suits 99% sites right out of the box 5 visual field styles included: classic, flat, material, classic rounded, flat rounded Set any form width Set the title above the form Place any text you need before the form Pin a picture, a logo or a photo over your form Editable label of the Submit button Set a text to accompany successful submission of the message All data entered to the form is saved in progress Google reCAPTCHA is here to give your form protection from spam and bots Installation in 1-2-3 This plugin is unbelievably easy to install. After downloading the plugin zip, you need to install it on your website, create and configure a plugin, and copy-paste its code into any page or your website template. To further enhance your website’s functionality, Elfsight offers a variety of other useful widgets. For example, you can integrate the Instagram Feed to showcase your social media visuals, the LinkedIn Feed to display professional updates, or the Google Reviews widget to build trust by featuring customer feedback. Looking for an all-in-one solution? The All-in-one Reviews widget consolidates reviews from different platforms in one place. You can also enable instant communication through the WhatsApp Chat, or keep your audience informed with the Event Calendar. See more cool WordPress plugins by Elfsight for your website.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C