Real Testimonials Pro
Monthly
Supply-chain compromise of three commercial WordPress plugins - Smart Post Show Pro (before 4.0.2), Real Testimonials Pro (before 3.2.5), and Product Slider for WooCommerce Pro (before 3.5.3) - shipped malicious code via the vendor's compromised update server, letting remote unauthenticated attackers deploy a second-stage payload that harvests credentials and other sensitive data and takes full control of affected sites. Publicly available exploit code exists and a patch is available from the vendor, but there is no public exploit identified as being used for active exploitation and the flaw is not in CISA KEV. EPSS is low (0.20%, 10th percentile), consistent with the malicious builds having been pulled once discovered rather than being mass-exploited in the wild.
Supply-chain compromise of three commercial WordPress plugins - Smart Post Show Pro (before 4.0.2), Real Testimonials Pro (before 3.2.5), and Product Slider for WooCommerce Pro (before 3.5.3) - shipped malicious code via the vendor's compromised update server, letting remote unauthenticated attackers deploy a second-stage payload that harvests credentials and other sensitive data and takes full control of affected sites. Publicly available exploit code exists and a patch is available from the vendor, but there is no public exploit identified as being used for active exploitation and the flaw is not in CISA KEV. EPSS is low (0.20%, 10th percentile), consistent with the malicious builds having been pulled once discovered rather than being mass-exploited in the wild.