Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.4

BNE Testimonials Plugin Stored XSS via Slider Shortcode

CVE-2026-15245 · published 2 months ago
Summary

The BNE Testimonials WordPress plugin is vulnerable to a stored cross-site scripting attack. This means that users with contributor access can inject malicious code into the plugin, which can be executed by anyone viewing the affected content. To protect your site, update the plugin to version 2.0.8.2 or later.

What to do
  • Update unknown bne testimonials to version 2.0.8.2 or later.
Affected software
VendorProductAffected versions
unknown bne testimonials < 2.0.8.2
Original advisory text
The BNE Testimonials WordPress plugin before 2.0.8.2 does not properly escape a shortcode attribute for a JavaScript context before echoing it into an inline script, allowing users with the contrib...
The BNE Testimonials WordPress plugin before 2.0.8.2 does not properly escape a shortcode attribute for a JavaScript context before echoing it into an inline script, allowing users with the contributor role and above to inject arbitrary JavaScript that executes in the browser of anyone viewing the affected content.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
5.4 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published7 Aug 2026
Updated4 Nov 2026
First seen7 Aug 2026
Sources
CVE-2026-15245 · NVD
CVE-2026-15245 · MITRE
Track software like this
Free during beta