CVE-2026-8039 describes a stored cross-site scripting vulnerability in the Fancy Testimonials WordPress plugin by dijitul. The issue exists in all versions up to and including 1.0, where the 'author' shortcode attribute in the 'testimonial' shortcode does not properly sanitize or escape input. This allows authenticated attackers with Contributor or higher privileges to inject arbitrary web scripts that execute in the context of users viewing the injected content. The CVSS 3.1 base score is 6.4, reflecting a medium severity with network attack vector, low attack complexity, and privileges required at the contributor level. There is no official patch or remediation level indicated, and no known exploits in the wild have been reported.

An attacker with Contributor-level or higher access can inject malicious scripts via the 'author' shortcode attribute, leading to stored XSS. This can result in the execution of arbitrary scripts in the browsers of users who view the affected pages, potentially leading to session hijacking, defacement, or other client-side attacks. The confidentiality and integrity of user interactions with the site can be compromised, but availability is not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider disabling or removing the Fancy Testimonials plugin if possible. Monitor for updates from the vendor or plugin author regarding patches or official mitigations.