WordPress Testimonials by BestWebSoft plugin 1.0.5-1.0.8 - Unauthenticated SQLi vulnerability

Unauthenticated SQLi vulnerability discovered by Enrico Marcolini, Claudio Marchesini, Dottor Marc in WordPress Plugin Testimonials by BestWebSoft versions 1.0.5-1.0.8...

CVE-2026-89235

The Testimonials by BestWebSoft WordPress plugin through 1.0.8 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL to the query...

CVE-2026-89235 Testimonials by BestWebSoft 1.0.5 - 1.0.8 - Unauthenticated SQLi via 'offset' Parameter

The Testimonials by BestWebSoft WordPress plugin through 1.0.8 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL to the query...

CVE-2026-89235

The Testimonials by BestWebSoft WordPress plugin, versions 1.0.5 through 1.0.8 , is vulnerable to an unauthenticated SQL injection vulnerability. The flaw exists because the plugin fails to properly sanitize and escape a parameter before incorporating it into a SQL query . This allows unauthentic...

EUVD-2026-95705

The Testimonials by BestWebSoft WordPress plugin through 1.0.8 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL to the query...

PT-2026-108873

The Testimonials by BestWebSoft WordPress plugin through 1.0.8 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL to the query...