WP Testimonials

WP Testimonials has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2026; 2 are fixed and 1 remains unpatched as of October 2026. Their average CVSS score is 6.5, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 1 high.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (33%). Other recurring categories include Cross-Site Scripting, SQL Injection.

2 of the records (67%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2026.

3 independent researchers contributed these findings, one record each.

Strategic Overview

Avg CVSSMedium

6.5/ 10

Patch Coverage67%

Open

Fixed

Get automatic notifications for all WP Testimonials vulnerabilities before they are exploited.

Most severe open issueCVSS 6.4CVE-2026-89269

WP Testimonials <= 1.4.13 - Authenticated (Author+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

3 records


2026-10-13 00:00	WP Testimonials <= 1.4.13 - Authenticated (Author+) Stored Cross-Site Scripting WP Testimonials <= 1.4.13	`CVE-2026-89269`	6.4 Medium	Jaze	No
2024-01-12 00:00	WP Testimonials <= 1.4.3 - Authenticated (Contributor+) SQL Injection WP Testimonials <= 1.4.3	`CVE-2024-25924`	8.8 High	Le Ngoc Anh	Yes
2023-07-14 00:00	WP Testimonials <= 1.4.2 - Cross-Site Request Forgery to Widget Deletion WP Testimonials < 1.4.3	`CVE-2023-2830`	4.3 Medium	Skalucy	Yes

Showing 1–3 of 3 reports