CVE-2026-89269: WP Testimonials <= 1.4.13 - Author+ Stored XSS via wp-testimonials Shortcode
The WP Testimonials WordPress plugin through 1.4.13 does not properly escape testimonial content and reverses WordPress's HTML sanitization when rendering it, allowing users with the Author role and above to store JavaScript that executes in the session of any user viewing the testimonials, including administrators.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A user with the WordPress Author role or any higher-privileged role can exploit it by submitting malicious testimonial content.
Who is affected when malicious content is stored?
Any user who views the rendered testimonials can have JavaScript executed in their browser session, including WordPress administrators.
What condition is required for exploitation?
The attacker must have an Author-level or higher account and must be able to place content that is rendered through the wp-testimonials shortcode.
Are versions after 1.4.13 confirmed affected?
The available information identifies WP Testimonials versions through 1.4.13 as affected. It does not state whether later versions are affected or fixed.