Security Alert Summary
The WP Testimonials WordPress plugin through 1.4.13 contains a stored cross-site scripting (XSS) issue. The plugin does not properly escape testimonial content and reverses WordPress HTML sanitization when rendering testimonials, which allows users with the Author role and above to store JavaScript that executes in the session of any user viewing the testimonials, including administrators.
CVE Details
- CVE ID: CVE-2026-89269
- Affected component: WP Testimonials WordPress plugin
- Affected versions: Versions up to and including 1.4.13
- Published: October 13, 2026 at 6:17:03 AM UTC
- Last modified: October 13, 2026 at 4:29:21 PM UTC
- CVSS v3.1 base score: 6.8 (Medium)
- CVSS v3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
- Authentication / privileges / user interaction:
- Authenticated: attacker must have an account (Author role or higher, per the vulnerability description)
- Privileges required: High (PR:H)
- User interaction: Required (UI:R)
- Primary impact: Confidentiality: High; Integrity: High; Availability: High
- Weakness: CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-site Scripting)
Technical Details
The plugin fails to properly escape testimonial content and reverses WordPress HTML sanitization when rendering testimonials. As a result, testimonials submitted by users with the Author role or above can include JavaScript that is stored by the plugin and later executed in the browser of any user who views the testimonials, including administrators.
This is a stored XSS issue: malicious script content persists in the site database as part of a testimonial and is executed on page render for viewers of that content. The vulnerability exists because the rendering path bypasses or undoes WordPress built-in sanitization and escaping for HTML stored in testimonial entries.
Impact is limited to script execution in the context of users who view the affected testimonial output. That script can access the viewing user’s session and any data available in-browser to that user, consistent with the confidentiality and integrity impacts noted in the CVSS data.
How This Could Impact Your Website
Consider a site with multiple WordPress accounts: a site owner, internal staff who contribute content, and an external contractor who manages testimonials. If an account with Author-level access submits a testimonial containing malicious JavaScript, that script could run when other users view the testimonials. For example:
- An administrator viewing the testimonials page could have their session exposed to the script, potentially revealing session cookies or allowing actions to be performed in the administrator’s browser context.
- User profile details or visible email addresses could be harvested by the injected script, increasing the chance of targeted phishing or social engineering against staff or contractors.
- Malicious scripts could modify displayed content or interact with other client-side features, affecting integrity of what users see.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles; limit Author-level privileges where possible.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins that increase your attack surface.
- Monitor site activity and logs for unusual behavior, especially changes to testimonial content and unexpected administrator actions.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team is happy to help.
