Description

The BNE Testimonials WordPress plugin before 2.0.8.2 does not properly escape a shortcode attribute for a JavaScript context before echoing it into an inline script, allowing users with the contributor role and above to inject arbitrary JavaScript that executes in the browser of anyone viewing the affected content.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-07T06:16:55.350Z",
  "pubdate": "2026-08-07T06:16:55.350Z",
  "executiveSummary": "A stored cross-site scripting (XSS) vulnerability exists in the BNE Testimonials WordPress plugin prior to version 2.0.8.2. The flaw arises from improper sanitization and output escaping of shortcode attributes destined for JavaScript execution contexts.\nAuthenticated attackers possessing the contributor role or higher can inject malicious JavaScript payloads via vulnerable shortcode parameters. When a victim or administrator views the affected page containing the rendered shortcode, the injected script executes within the context of their browser session.\nThe primary impact of successful exploitation includes session hijacking, credential theft, unauthorized actions performed on behalf of the victim, and potential privilege escalation if an administrative user views the payload. Exploitation requires authenticated access with at least contributor-level privileges within the WordPress application, coupled with user interaction in the form of viewing the compromised content.",
  "technicalDetails": "The vulnerability resides in the handling of shortcode attributes within the BNE Testimonials WordPress plugin for versions before 2.0.8.2. Specifically, the plugin processes user-supplied shortcode parameters and echoes them directly into an inline JavaScript context without applying adequate contextual output escaping or sanitization.\nIn WordPress environments, users with the contributor role possess the capability to submit posts and utilize specific shortcodes, though their content typically requires administrative review before publishing. If an attacker leverages this capability, they can craft a malicious shortcode containing JavaScript payload strings designed to break out of the intended inline script boundaries.\nThe step-by-step attack flow proceeds as follows: First, the authenticated attacker with contributor privileges creates or edits a post or page, embedding the malicious shortcode with a specially crafted payload in an attribute. Second, the server parses the shortcode, retrieves the unsafe attribute value, and injects it directly into the generated inline script block without transformation. Third, the post is saved and subsequently published or viewed. Finally, when a user or administrator loads the affected content in their browser, the Document Object Model (DOM) parses the inline script, and the browser executes the injected arbitrary JavaScript code in the security context of the victim's session.\nBecause the payload executes inside the victim's browser, the attacker can leverage standard post-exploitation JavaScript techniques to interact with the WordPress REST API, perform unauthorized state-changing requests, steal session cookies, or inject persistent administrative backdoors, depending on the privileges of the user viewing the vulnerable page. The attack surface is exposed locally within the authenticated admin or front-end rendering context wherever the shortcode is processed and displayed."
}