PT-2026-50651 · WordPress · Fancy Testimonials

Zakaria · CVE-2026-8039 · Published 2026-06-18 · Updated 2026-06-25

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Fancy Testimonials versions prior to 1.1

Description The Fancy Testimonials plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs due to insufficient input sanitization and output escaping within the author attribute of the testimonial shortcode. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages, which then execute when a user visits the affected page.

Recommendations Update the plugin to a version later than 1.0. As a temporary workaround, restrict the ability of users with Contributor-level access to use the testimonial shortcode or the author attribute.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-8039

Affected Products

Fancy Testimonials

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-8039 · Security Note
• https://plugins.trac.wordpress.org/browser/fancy-testimonials/tags/1.0/testimonials.php#L33 · Note
• https://reddit.com/r/StopBadBots/comments/1ufl33j/critical_security_alert_unpatched_plugins_listed · Reddit Post
• https://wordfence.com/threat-intel/vulnerabilities/id/cf7adeb3-4c6b-4181-af07-0acb1fc8cdb0?source=cve · Note
• https://t.me/CVEtracker/57234 · Telegram Post
• https://plugins.trac.wordpress.org/browser/fancy-testimonials/trunk/testimonials.php#L33 · Note