CVE-2026-89269 WP Testimonials CVE debrief

Who should care

Defenders responsible for WordPress installations using the WP Testimonials plugin should assess exposure and prioritize verification of the plugin version in use. Administrators viewing testimonials may be affected by stored JavaScript and should be cautious. Security teams managing WordPress environments should review and update their security measures to address this vulnerability. Operators of WordPress platforms with the WP Testimonials plugin should

Why it matters

The WP Testimonials plugin vulnerability allows stored XSS, impacting defenders who must verify plugin versions and administrators viewing testimonials.

• Defenders must verify the WP Testimonials plugin version to determine exposure
• Administrators viewing testimonials may be affected by stored JavaScript

Technical summary

The WP Testimonials plugin through version 1.4.13 for WordPress does not properly escape testimonial content, allowing users with the Author role and above to store JavaScript that executes in the session of any user viewing the testimonials, including administrators. This vulnerability is a stored XSS issue, which can lead to unauthorized JavaScript execution in the context of viewing testimonials. Defenders should focus on verifying plugin versions and ensuring they are up to date to mitigate this vulnerability. Additionally, monitoring for suspicious activity related to testimonial content can help detect potential exploitation attempts.

Defensive priority

Defenders should prioritize verifying the version of WP Testimonials in use and ensuring that it is up to date, as well as monitoring for suspicious activity related to testimonial content.

Recommended defensive actions

• Verify the version of WP Testimonials in use and ensure that it is up to date
• Monitor for suspicious activity related to testimonial content
• Consider implementing additional security measures to prevent XSS attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide limited information about the vulnerability, but indicate that it is a stored XSS vulnerability in the WP Testimonials plugin. Defenders should verify plugin versions and monitor for suspicious activity related to testimonial content. The vulnerability is confirmed in version 1.4.13 and below, with no explicit details on patched versions or additional mitigations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.