CVE-2026-15245

Deferred Deferred - Pending Action

BNE Testimonials Plugin DOM XSS via Shortcode Attribute

Publication date: 2026-08-07

Last updated on: 2026-08-26

Assigner: WPScan

Description

The BNE Testimonials WordPress plugin before 2.0.8.2 does not properly escape a shortcode attribute for a JavaScript context before echoing it into an inline script, allowing users with the contributor role and above to inject arbitrary JavaScript that executes in the browser of anyone viewing the affected content.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-07

Last Modified

2026-08-26

Generated

2026-08-27

AI Q&A

2026-08-07

EPSS Evaluated

2026-08-26

NVD

CVE-2026-15245

EUVD

EUVD-2026-54381

Affected Vendors & Products

Vendor	Product	Version / Range
bne_testimonials	plugin	to 2.0.8.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a stored Cross-Site Scripting (XSS) vulnerability in the BNE Testimonials WordPress plugin before version 2.0.8.2. It occurs because the plugin does not properly escape a shortcode attribute used in a JavaScript context, allowing users with contributor role or higher to inject malicious JavaScript code that executes when others view the affected content.

Detection Guidance

Check WordPress plugin versions. Use WP-CLI with 'wp plugin list' to see installed versions. Look for BNE Testimonials versions before 2.0.8.2. Inspect pages using affected shortcodes for unexpected JavaScript behavior.

Impact Analysis

Attackers with contributor access or higher can inject malicious scripts into your WordPress site. When visitors view the affected content, the injected scripts run in their browsers, potentially stealing cookies, session tokens, or other sensitive data. This could lead to account takeovers or unauthorized actions on behalf of users.

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR and HIPAA requirements for protecting user data. If exploited, it may result in unauthorized access to personal or health information, leading to legal penalties, fines, and reputational damage for organizations handling sensitive data.

Mitigation Strategies

Update the BNE Testimonials plugin to version 2.0.8.2 or later immediately. Remove or disable the plugin if an update is not available. Review user roles and restrict contributor-level access to trusted users only.

Hi! I’m here to help you understand CVE-2026-15245. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70