What’s Vulnerable › Vulnerabilities
CVE-2026-89269: WP Testimonials <= 1.4.13 - Author+ Stored XSS via wp-testimonials Shortcode
- Severity: medium (CVSS 6.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-13 · updated 2026-10-13
- Weakness: CWE-79
Description
The WP Testimonials WordPress plugin through 1.4.13 does not properly escape testimonial content and reverses WordPress's HTML sanitization when rendering it, allowing users with the Author role and above to store JavaScript that executes in the session of any user viewing the testimonials, including administrators.
Affected products
- WP Testimonials: through 1.4.13
References
Get alerted when CVE-2026-89269 or the next vulnerability affects your stack