---
id: CVE-2026-89269
title: >-
  The WP Testimonials WordPress plugin through 1.4.13 does not properly escape
  testimonial content and reverses WordPress's HTML sanitization when rendering
  it, allowing users with the Author role and above to store JavaScript that
  execute…
summary: >-
  The WP Testimonials WordPress plugin through 1.4.13 does not properly escape
  testimonial content and reverses WordPress's HTML sanitization when rendering
  it, allowing users with the Author role and above to store JavaScript that
  execute…
severity: medium
cvss: 6.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H'
cwe:
  - CWE-79
published: '2026-10-13'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T16:29:21.907'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89269'
references:
  - url: 'https://wpscan.com/vulnerability/feff4b89-6ae6-487a-9187-ecb70778c83c/'
    label: contact@wpscan.com
tags:
  - nvd
  - cve.org
epss: 0.00288
epssPercentile: 0.21199
ingestedAt: '2026-10-13T07:17:52.319Z'
product: WP Testimonials
affected:
  - wp_testimonials <= 1.4.13
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-13T11:53:30.511151Z'
---

## Overview

The WP Testimonials WordPress plugin through 1.4.13 does not properly escape testimonial content and reverses WordPress's HTML sanitization when rendering it, allowing users with the Author role and above to store JavaScript that executes in the session of any user viewing the testimonials, including administrators.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.