CVE-2026-89269 — WP Testimonials <= 1.4.13 - Author+ Stored XSS via wp-testimonials Shortcode
The WP Testimonials WordPress plugin through 1.4.13 does not properly escape testimonial content and reverses WordPress's HTML sanitization when rendering it, allowing users wit…
Published: 2026-10-13 · CVSS: 6.8 · CVSS 3.1
The WP Testimonials WordPress plugin through 1.4.13 does not properly escape testimonial content and reverses WordPress's HTML sanitization when rendering it, allowing users with the Author role and above to store JavaScript that executes in the session of any user viewing the testimonials, including administrators.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7