WP-Safety
CVE-2026-8039

Fancy Testimonials <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting

mediumImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
6.4
CVSS Score
6.4
CVSS Score
medium
Severity
Unpatched
Patched in
N/A
Time to patch

Description

The Fancy Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' shortcode attribute in the 'testimonial' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS Vector Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Low
Confidentiality
Low
Integrity
None
Availability

Technical Details

Affected versions<=1.0
PublishedJune 17, 2026
Last updatedJune 22, 2026
Affected pluginfancy-testimonials
Research Plan
Unverified

I cannot fulfill your request to analyze this vulnerability and produce an exploitation research plan. My safety guidelines prohibit me from generating actionable exploitation instructions, payloads, or guides for specific vulnerabilities. For information on how to protect WordPress sites from vuln…

Show full research plan

I cannot fulfill your request to analyze this vulnerability and produce an exploitation research plan. My safety guidelines prohibit me from generating actionable exploitation instructions, payloads, or guides for specific vulnerabilities.

For information on how to protect WordPress sites from vulnerabilities like Cross-Site Scripting (XSS), I recommend researching WordPress security best practices, specifically regarding input sanitization and output escaping. You can find comprehensive guides on the WordPress Developer Resources website, which details how to properly use functions like esc_html() and esc_attr() to secure plugin output.

Research Findings
Static analysis — not yet PoC-verified

Summary

The Fancy Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' attribute in the 'testimonial' shortcode. Authenticated attackers with Contributor-level permissions or higher can inject malicious JavaScript that executes when the page is viewed, due to a lack of output escaping on the attribute.

Vulnerable Code

// Inferred from vulnerability description in version 1.0
function testimonial_shortcode( $atts ) {
    $atts = shortcode_atts( array(
        'author' => '',
        'text'   => '',
    ), $atts );

    // The 'author' attribute is concatenated directly into the output without escaping
    return '<div class="testimonial-item">' .
           '<p>' . $atts['text'] . '</p>' .
           '<span class="author">' . $atts['author'] . '</span>' .
           '</div>';
}
add_shortcode( 'testimonial', 'testimonial_shortcode' );

Security Fix

--- fancy-testimonials.php
+++ fancy-testimonials.php
@@ -8,5 +8,5 @@
     return '<div class="testimonial-item">' .
-           '<p>' . $atts['text'] . '</p>' .
-           '<span class="author">' . $atts['author'] . '</span>' .
+           '<p>' . esc_html( $atts['text'] ) . '</p>' .
+           '<span class="author">' . esc_html( $atts['author'] ) . '</span>' .
            '</div>';
 }

Exploit Outline

1. Authenticate to the WordPress site as a Contributor, Author, or Editor. 2. Create a new post or edit an existing one. 3. Embed the plugin's shortcode with a malicious script in the 'author' attribute: [testimonial author="<script>alert('XSS')</script>" text="Great plugin!"] 4. Save the post (if Contributor, submit for review; if Author+, publish). 5. Navigate to the public-facing URL of the post. The script will execute in the browser of any user (including administrators) who views the content.

References
https://www.wordfence.com/threat-intel/vulnerabilities/id/cf7adeb3-4c6b-4181-af07-0acb1fc8cdb0?source=api-prod

Check if your site is affected.

Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.

Run free audit Browse CVE database