EUVD-2026-54381
GHSA-34j2-7r4g-h79x
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Contributor-level auth (PR:L) required; victim must view the page (UI:R); stored XSS crosses browser trust boundary (S:C) with limited session/DOM impact but no server-side availability loss.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The BNE Testimonials WordPress plugin before 2.0.8.2 does not properly escape a shortcode attribute for a JavaScript context before echoing it into an inline script, allowing users with the contributor role and above to inject arbitrary JavaScript that executes in the browser of anyone viewing the affected content.
AnalysisAI
Stored cross-site scripting in BNE Testimonials WordPress plugin (all versions before 2.0.8.2) allows contributor-level authenticated users to inject arbitrary JavaScript into an inline script block via an unescaped shortcode attribute. The payload persists in published content and executes in the browser of any visitor who views the affected page, including administrators. A public proof-of-concept is documented by WPScan; however, the vulnerability is not listed in CISA KEV and EPSS sits at the 5th percentile, indicating low automated exploitation probability.
Technical ContextAI
BNE Testimonials implements WordPress shortcodes to render testimonial content. The flaw (CWE-79, Improper Neutralization of Input During Web Page Generation) occurs when a shortcode attribute is concatenated directly into an inline JavaScript block without JavaScript-context escaping - a distinct requirement from HTML-context escaping and requiring functions such as esc_js() or json_encode(). This allows a contributor to break out of the expected string literal and inject arbitrary executable code. The CVSS scope-change (S:C) reflects that the trust boundary is crossed from the contributor's content to every visitor's browser session. CPE cpe:2.3:a:unknown:bne_testimonials:*:*:*:*:*:*:*:* covers all affected versions; the vendor field is listed as 'unknown' in NVD, indicating incomplete vendor registration.
RemediationAI
Update the BNE Testimonials WordPress plugin to version 2.0.8.2 or later, which applies proper JavaScript-context escaping to the vulnerable shortcode attribute; this is the vendor-confirmed fix per the WPScan advisory at https://wpscan.com/vulnerability/7399dd14-66a3-4747-aeb2-001ff6c31397/. The update can be applied via the WordPress admin dashboard under Plugins → Available Updates. If immediate patching is not feasible, restrict the Contributor role to fully trusted users only and disable open user registration to close the exploitation gate; note this does not eliminate risk from already-registered contributors. Additionally, audit existing posts and pages authored by contributor-role users for unexpected or obfuscated JavaScript within testimonial shortcodes. No documented side effects to upgrading to 2.0.8.2 are available.
More in Bne Testimonials
View allSame weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today