{"id":"CVE-2026-89269","title":"The WP Testimonials WordPress plugin through 1.4.13 does not properly escape testimonial content and reverses WordPress's HTML sanitization when rendering it, allowing users with the Author role and above to store JavaScript that execute…","summary":"The WP Testimonials WordPress plugin through 1.4.13 does not properly escape testimonial content and reverses WordPress's HTML sanitization when rendering it, allowing users with the Author role and above to store JavaScript that execute…","severity":"none","published":"2026-10-13","updated":"2026-10-13","sourceUpdated":"2026-10-13T06:17:03.683","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89269","references":[{"url":"https://wpscan.com/vulnerability/feff4b89-6ae6-487a-9187-ecb70778c83c/","label":"contact@wpscan.com"}],"tags":["nvd"],"ingestedAt":"2026-10-13T07:17:52.319Z","slug":"CVE-2026-89269","body":"## Overview\n\nThe WP Testimonials WordPress plugin through 1.4.13 does not properly escape testimonial content and reverses WordPress's HTML sanitization when rendering it, allowing users with the Author role and above to store JavaScript that executes in the session of any user viewing the testimonials, including administrators.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}