CVE-2026-89269 WP Testimonials <= 1.4.13 - Author+ Stored XSS via wp-testimonials Shortcode

The WP Testimonials WordPress plugin through 1.4.13 does not properly escape testimonial content and reverses WordPress's HTML sanitization when rendering it, allowing users with the Author role and above to store JavaScript that executes in the session of any user viewing the testimonials,...

CVE-2026-16786

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dslcmoduletestimonialsoutput Shortcode in all versions up to, and including, 2.1.19 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-16786

The Live Composer – Free WordPress Website Builder plugin (versions ≤ 2.1.19) is vulnerable to Stored Cross-Site Scripting via the dslc_module_testimonials_output Shortcode. The root cause is insufficient input sanitization and output escaping: the injected payload survives save-time wp_kses_post...

PT-2026-84133

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dslc module testimonials output Shortcode in all versions up to, and including, 2.1.19 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-31074

Name of the Vulnerable Software and Affected Versions Strong Testimonials versions up to and including 3.2.21 Description The Strong Testimonials plugin for WordPress is susceptible to Stored Cross-Site Scripting through the testimonial view shortcode. Insufficient input sanitization and output...

WordPress Stars Testimonials plugin <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via stars_testimonials Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via starstestimonials Shortcode vulnerability discovered by Peter Thaleikis in WordPress Plugin Stars Testimonials versions = 3.3.1...