CyberRota Analysis
AI-GeneratedThe BNE Testimonials WordPress plugin prior to version 2.0.8.2 is vulnerable due to improper escaping of a shortcode attribute in a JavaScript context, enabling users with contributor roles and higher to inject malicious JavaScript. This flaw poses a significant risk as it allows for cross-site scripting (XSS) attacks, potentially compromising the security of users viewing the affected content. WordPress site administrators and developers utilizing this plugin should prioritize updating to the latest version to mitigate this vulnerability.
Original NVD Description
The BNE Testimonials WordPress plugin before 2.0.8.2 does not properly escape a shortcode attribute for a JavaScript context before echoing it into an inline script, allowing users with the contributor role and above to inject arbitrary JavaScript that executes in the browser of anyone viewing the affected content.