First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-89235

MediumCVSS 6.8/10Last modified Oct 9, 2026

Description

The Testimonials by BestWebSoft WordPress plugin through 1.0.8 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL to the query.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
Unknown	Testimonials by BestWebSoft	>= 1.0.5, <= 1.0.8

References

https://wpscan.com/vulnerability/00801815-efc8-41f7-9984-0e81698c7f68/

Timeline

Published: Oct 9, 2026
Last modified: Oct 9, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-892368.6The SaveTo Wishlist Lite WordPress plugin before 1.1.5 does not sanitise and escape parameters before using them in the ORDER BY clause of CVE-2026-892376.8The Bluff Post WordPress plugin through 1.1.1 does not sanitise and escape parameters before using them as identifiers in a SQL query, allow CVE-2026-892389.1WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the decrypted header, leading to incorrect c CVE-2026-892396.1WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in the showAlert CVE-2026-89249.1A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set "super cookies" that bypass the Public Suffix List check. This e CVE-2026-892406.1WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Live/c CVE-2026-892416.1WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in confirmLivePa CVE-2026-892427.2WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a server-side request forgery vulnerability in the _json_decode CVE-2026-892438.1WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in UserGroups::setG CVE-2026-892446.1WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Galler CVE-2026-892456.5WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in playlistRemove.ph CVE-2026-892465.4WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a CSV formula injection vulnerability in the myComments.downloa

CVE-2026-89235: Medium severity, CVSS 6.8 | Vulnix