Super Testimonial – Testimonial & Customer Review Slider Plugin for WordPress Security & Risk Analysis

The 'super-testimonial' plugin version 5.0.0 demonstrates several positive security practices, including a high percentage of properly escaped output and the exclusive use of prepared statements for SQL queries. The absence of dangerous functions, file operations, and external HTTP requests is also encouraging. However, the presence of one unprotected AJAX handler represents a significant concern, creating a direct entry point for potential unauthenticated attacks.

The plugin's vulnerability history is a major red flag. With five known CVEs, including one high-severity and four medium-severity issues, and a recent vulnerability reported in early 2025, the plugin has a clear pattern of past security weaknesses. The common vulnerability types (XSS) suggest potential issues with input validation and output sanitization, even with the otherwise good static analysis results for output escaping. This history, coupled with the unprotected AJAX handler, indicates a need for caution.

In conclusion, while 'super-testimonial' v5.0.0 has some strong security fundamentals, the historical vulnerability trend and the single unprotected AJAX entry point present notable risks. Users should be aware of the past issues and the potential for further vulnerabilities, even if current static analysis appears favorable.