Executive brief
BNE Testimonials is a WordPress plugin used to display customer reviews and testimonials on websites. A security vulnerability allows users with 'Contributor' level access to inject malicious scripts into the site. If an administrator or visitor views the affected content, these scripts could steal session information, redirect users to malicious websites, or deface the site.
Technical details
A Stored Cross-Site Scripting (XSS) vulnerability exists in the BNE Testimonials plugin for WordPress (versions <= 2.0.8) due to insufficient input sanitization and output escaping. An attacker with 'Contributor' level privileges can inject arbitrary JavaScript into testimonial fields. This script executes in the context of a victim's browser (such as an administrator) when they navigate to the page where the malicious testimonial is rendered. The vulnerability requires user interaction (viewing the page) and has a 'Changed' scope impact, potentially allowing for session hijacking or unauthorized administrative actions. As of the advisory date, no official patch has been released.
Affected products
- Kerry (BNE Creative) BNE Testimonials <= 2.0.8
Timeline
- 2025-10-15: other: Vulnerability reported by researcher
- 2026-06-26: disclosed: Public disclosure by Patchstack