The BNE Testimonials WordPress plugin versions prior to 2.0.8.2 contain a CWE-79 Cross-Site Scripting vulnerability. The issue arises from improper escaping of a shortcode attribute within an inline JavaScript context. Users with contributor or higher roles can exploit this to inject and execute arbitrary JavaScript in the context of other users viewing the content, potentially leading to session hijacking, defacement, or other client-side attacks. No CVSS score or vendor advisory is currently available, and no patch or remediation details have been published.

This vulnerability allows authenticated users with contributor or higher privileges to inject malicious JavaScript code that executes in the browsers of other users viewing the affected content. This can lead to client-side attacks such as session hijacking, unauthorized actions performed on behalf of users, or content manipulation. The impact is limited to users who can create or edit content and those who view that content.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor and higher roles from adding or editing content that uses the vulnerable shortcode or disable the BNE Testimonials plugin if possible.