CVE-2026-89269: CWE-79 Cross-Site Scripting (XSS) in WP Testimonials

CVE-2026-89269 is a CWE-79 Cross-Site Scripting vulnerability in the WP Testimonials WordPress plugin versions up to and including 1.4.13. The plugin improperly handles testimonial content by reversing WordPress's built-in HTML sanitization during rendering, enabling users with Author role or above to store malicious JavaScript. This script executes in the session of any user who views the testimonials, potentially leading to session hijacking or other script-based attacks.

Users with Author role or higher can inject JavaScript code that executes in the browser of any user viewing the testimonials, including administrators. This can lead to unauthorized actions performed in the context of the victim's session, such as session hijacking, privilege escalation, or other malicious activities facilitated by script execution.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Author role capabilities or disable the WP Testimonials plugin to prevent exploitation.