CVE-2026-89269
6.8MediumPublished 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- Required
- Impact
- Full C/I/A compromise
- Weakness
- CWE-79
Impact
Authenticated attackers with the Author role can execute arbitrary JavaScript in the context of viewing administrators, leading to account takeover. This requires network access, an Author account or higher, and an administrator to view the affected testimonial page.
Root cause
The plugin actively reverses WordPress HTML sanitization and fails to escape testimonial content before rendering it.
Affected systems
WP Testimonials plugin through version 1.4.13.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Fix & remediation
No fixed version is specified in the advisory; deactivate and delete the plugin immediately or restrict Author-level access until a patch is available.
$ wp plugin deactivate wp-testimonialsAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
The WP Testimonials WordPress plugin through 1.4.13 does not properly escape testimonial content and reverses WordPress's HTML sanitization when rendering it, allowing users with the Author role and above to store JavaScript that executes in the session of any user viewing the testimonials, including administrators.