Unknown Testimonials Widget vulnerabilities

2 CVEs affecting Unknown Testimonials Widget, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-96533, published 2026-09-26.

More from Unknown.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-96532, published 2026-09-26. High severity, CVSS 7.5. EPSS: 0.2% chance of exploitation in the next 30 days. The Testimonials Widget WordPress plugin through 4.0.4 does not perform a capability or ownership check when handling its front-end testimonial submission form, allowing unauthenticated users to…
• CVE-2026-96533, published 2026-09-26. Medium severity, CVSS 5.8. EPSS: 0.2% chance of exploitation in the next 30 days. The Testimonials Widget WordPress plugin through 4.0.4 does not validate a user-supplied URL before fetching it server-side and storing the response as a public file, allowing unauthenticated users…