CVE-2025-68075

Deferred Deferred - Pending Action

Cross-Site Scripting (XSS) in BNE Testimonials <= 2.0.8

Publication date: 2026-06-26

Last updated on: 2026-06-29

Assigner: Patchstack

Description

Contributor Cross Site Scripting (XSS) in BNE Testimonials <= 2.0.8 versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-26

Last Modified

2026-06-29

Generated

2026-07-17

AI Q&A

2026-06-26

EPSS Evaluated

2026-07-15

NVD

CVE-2025-68075

EUVD

EUVD-2025-210361

Affected Vendors & Products

Vendor	Product	Version / Range
patchstack	bne_testimonials	to 2.0.8 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

The WordPress BNE Testimonials Plugin, versions 2.0.8 and below, contains a Cross Site Scripting (XSS) vulnerability. This security flaw allows attackers to inject malicious scripts into websites using the plugin.

Exploitation requires user interaction, such as clicking a malicious link or visiting a specially crafted page.

Impact Analysis

This vulnerability can lead to attackers executing malicious scripts in the context of the affected website, potentially compromising user data, session tokens, or performing unauthorized actions.

The CVSS score of 6.5 indicates a moderate risk, meaning the impact can be significant but requires user interaction to exploit.

Users of the plugin are advised to update immediately or seek assistance to mitigate the risk.

Compliance Impact

The provided information does not specify how the Cross Site Scripting (XSS) vulnerability in BNE Testimonials Plugin versions 2.0.8 and below impacts compliance with common standards and regulations such as GDPR or HIPAA.

Mitigation Strategies

The immediate step to mitigate this vulnerability is to update the BNE Testimonials WordPress plugin to a version higher than 2.0.8 as soon as an official patch becomes available.

If an official patch is not yet available, users are advised to seek assistance from their hosting provider or web developer to apply temporary mitigations or workarounds.

Hi! I’m here to help you understand CVE-2025-68075. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70