{
 "id": "WPSEC-2026-2876",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2876/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2876/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2876/index.md",
 "title": "Real Testimonials <= 4.1.1 - Unauthenticated CSV Injection via Testimonial Form Fields",
 "description": "The Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials plugin for WordPress is vulnerable to CSV Injection via testimonial fields submitted through the front-end testimonial form (such as the reviewer name, designation, company name and location) in all versions up to, and including, 4.1.1, due to the testimonial CSV export writing field values without neutralizing cells that begin with formula characters (=, +, -, @, tab, carriage return) and without quoting them. This makes it possible for unauthenticated attackers to submit a testimonial whose values are interpreted as spreadsheet formulas, or break out of their cell, when an administrator exports the published testimonials to CSV and opens the file in a spreadsheet application.",
 "plugin": {
  "slug": "testimonial-free",
  "name": "Real Testimonials",
  "full_name": "Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials",
  "wordpress_org": "https://wordpress.org/plugins/testimonial-free/",
  "advisories_url": "https://wpsec.com/vuln/plugin/testimonial-free/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/testimonial-free"
 },
 "type": "CSV INJECTION",
 "cwe": [
  "CWE-1236"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "3.1.0",
    "from_inclusive": true,
    "to": "4.1.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 3.1.0 before 4.1.2"
  ]
 },
 "introduced_in": "3.1.0",
 "fixed_in": "4.1.2",
 "remediation": "Update to 4.1.2 or later.",
 "fix_released": "2026-11-10T09:09:44+00:00",
 "published": "2026-11-12T17:52:14+00:00",
 "updated": "2026-11-12T17:07:57.710755+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2876/",
  "https://plugins.svn.wordpress.org/testimonial-free/tags/4.1.2/",
  "https://wordpress.org/plugins/testimonial-free/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/testimonial-free",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-12"
 }
}