Skip to content
CVE PROGRAM SOURCE RECORD6.8 Medium

CVE-2026-89269

WP Testimonials <= 1.4.13 - Author+ Stored XSS via wp-testimonials Shortcode

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WPScan

Description

The WP Testimonials WordPress plugin through 1.4.13 does not properly escape testimonial content and reverses WordPress's HTML sanitization when rendering it, allowing users with the Author role and above to store JavaScript that executes in the session of any user viewing the testimonials, including administrators.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Unknown WP Testimonials

Default version status: unknown

  • 0 to ≤ 1.4.13affected

References