Threat Database

Threat Entry Updated 2026-08-26

BNE Testimonials - Security Vulnerability (CVE-2026-15245)

The BNE Testimonials WordPress plugin before 2.0.8.2 does not properly escape a shortcode attribute for a JavaScript context before echoing it into an inline script, allowing users with the contributor role and above to inject arbitrary JavaScript that executes in the browser of anyone viewing the affected content.

PLUGIN BNE Testimonials

CVE-2026-15245

MEDIUM CVSS 5.4 2026-08-07

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-29

BNE Testimonials - Cross-Site Scripting (XSS) (CVE-2025-68075)

Contributor Cross Site Scripting (XSS) in BNE Testimonials

PLUGIN BNE Testimonials

CVE-2025-68075

MEDIUM CVSS 6.5 2026-06-26

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Bne Testimonials - Cross-Site Scripting (XSS) (CVE-2023-24411)

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Kerry Kline BNE Testimonials plugin

PLUGIN Bne Testimonials

CVE-2023-24411

MEDIUM CVSS 6.5 2023-04-06

Risk Score

Open Full Technical Breakdown