CVE-2026-15245

The BNE Testimonials plugin versions prior to 2.0.8.2 contain a stored cross-site scripting vulnerability in how the plugin's shortcode handler processes testimonial attributes. The shortcode accepts parameters (typically the testimonial ID or styling options) and outputs them into an inline JavaScript context — but the attribute values are not escaped using JavaScript-context sanitization (wp_json_encode or equivalent). Instead, the plugin uses HTML-context escaping functions, which do not prevent script execution when the value lands inside a `<script>` tag or JavaScript event handler. This is not merely a failure to sanitize — it's a contextual boundary error baked into WordPress's shortcode API. When you register a shortcode handler, shortcode_atts() parses attributes and hands you a plain key-value array with zero metadata about where those values will eventually render. A developer writing the handler sees 'I'm outputting an attribute value' — not 'I'm about to inject this into a JavaScript context that requires different escaping than HTML.' WordPress provides esc_html() and esc_attr() for HTML-context output, but the shortcode API provides no guidance or enforcement for JavaScript-context output. This creates a systematic blind spot that affects nearly every WordPress shortcode that injects into inline scripts. The CVSS 3.1 score of 5.4 reflects an 'authenticated contributor or above' requirement, but you should treat the actual blast radius as far wider. A contributor with write access can inject the malicious shortcode attribute into a testimonial post. Even if editorial review is required before publication, the execution radius is every unauthenticated visitor who loads the page containing that testimonial — not just WordPress users. The editorial gate reduces injection capability but does not limit who ultimately executes the payload in their browser. The jump to version 2.0.8.2 (from an earlier version, likely 2.0.8.1 or below) is a diagnostic signal you should not ignore. In plugin ecosystems, version jumps this large typically indicate either a rewrite or multiple failed incremental patches — each patch addressing the symptom (the specific attribute being exploited) without closing the root contextual boundary. That means the actual exposure window is longer than the CVE disclosure date implies. Check whether your installed version predates 2.0.8.2 and treat any version before that as vulnerable. What to do: Update to BNE Testimonials 2.0.8.2 or later immediately. If you cannot update, locate the shortcode handler in the plugin (typically in the main plugin file or a includes/shortcodes.php path) and verify that any attribute values being output into `<script>` blocks or inline JavaScript are wrapped with wp_json_encode() or json_encode() — not esc_html(), esc_attr(), or similar HTML-context functions. Review other shortcode handlers in your installed plugins for the same pattern: shortcode attributes concatenated into inline script without JavaScript-context escaping is a recurring vulnerability class in WordPress.

Reviewed through automated stages and approved by a human before publication.