BNE Testimonials < 2.0.8.2 – Contributor+ Stored XSS via Slider Shortcode | CVE 2026-15245 | Plugin Vulnerabilities

Description

The plugin does not properly escape a shortcode attribute for a JavaScript context before echoing it into an inline script, allowing users with the contributor role and above to inject arbitrary JavaScript that executes in the browser of anyone viewing the affected content.

Proof of Concept

Prerequisites:
- At least one published testimonial

Steps:

1. Create and publish a post with the following shortcode:
[bne_testimonials layout="slider" speed="7000, x:alert(document.domain)"]

2. Visit the post as any user.

Affects Plugins

bne-testimonials

Fixed in 2.0.8.2

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

testoun

Submitter

testoun

Verified

Yes

WPVDB ID

7399dd14-66a3-4747-aeb2-001ff6c31397

Timeline

Publicly Published

2026-08-03 (about 26 days ago)

Added

2026-08-03 (about 25 days ago)

Last Updated

2026-08-03 (about 25 days ago)

Other

Published

Title

Published

2025-02-26

Title

Site Reviews < 7.2.5 - Unauthenticated Stored XSS

Published

2017-03-01

Title

Atahualpa Theme - Authenticated Cross-Site Scripting (XSS)

Published

2022-10-05

Title

WooCommerce Ship to Multiple Addresses < 3.7.2 - Reflected Cross-Site Scripting

Published

2023-07-12

Title

Radio Forge Muses Player with Skins <= 2.5 - Reflected Cross-Site Scripting

Published

2014-08-01

Title

TinyMCE 3.5 - swfupload Cross-Site Scripting