Contributor Cross Site Scripting (XSS) in BNE Testimonials plugin allows an attacker to inject arbitrary JavaScript via unfiltered user input, leading to potential session hijacking, site defacement, or phishing attacks against visitors.

Kerry’s BNE Testimonials plugin for WordPress, any installation using version 2.0.8 or earlier, is affected.

The CVSS score of 6.5 indicates moderate severity. Exploitation is straightforward because the vulnerability occurs in an input field that is accessible to non‑authenticated users submitting testimonials. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that while exploitation is possible, it has not yet been widely observed. Sites that allow public testimonial submissions or administrative contribution are at risk.