---
id: CVE-2026-89269
title: >-
  The WP Testimonials WordPress plugin through 1.4.13 does not properly escape
  testimonial content and reverses WordPress's HTML sanitization when rendering
  it, allowing users with the Author role and above to store JavaScript that
  execute…
summary: >-
  The WP Testimonials WordPress plugin through 1.4.13 does not properly escape
  testimonial content and reverses WordPress's HTML sanitization when rendering
  it, allowing users with the Author role and above to store JavaScript that
  execute…
severity: none
published: '2026-10-13'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T06:17:03.683'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89269'
references:
  - url: 'https://wpscan.com/vulnerability/feff4b89-6ae6-487a-9187-ecb70778c83c/'
    label: contact@wpscan.com
tags:
  - nvd
ingestedAt: '2026-10-13T07:17:52.319Z'
---

## Overview

The WP Testimonials WordPress plugin through 1.4.13 does not properly escape testimonial content and reverses WordPress's HTML sanitization when rendering it, allowing users with the Author role and above to store JavaScript that executes in the session of any user viewing the testimonials, including administrators.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.