CVE-2025-11268
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
The Strong Testimonials plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to and including 3.2.16. This is due to the software allowing users to submit a testimonial in which a value is not properly validated or sanitized prior to being passed to a do_shortcode call. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes if an administrator previews or publishes a crafted testimonial.
Risk Assessment
Arbitrary shortcode execution could allow an attacker to perform unauthorized actions within the WordPress context, such as modifying content, stealing data, or taking over the site.
Recommendation
Update the Strong Testimonials plugin to the latest version. Additionally, administrators should be cautious when previewing and publishing testimonials from users.
Other vulnerabilities in Strong Testimonials
See all- CVE-2026-96650High
The Strong Testimonials plugin for WordPress is vulnerable to stored cross-site scripting via the 'platform_user_photo' custom field in versions up to and including 3.3.11. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. Exploitation requires an administrator to have added custom text fields 'platform' and 'platform_user_photo' to a public testimonial submission form.
- CVE-2026-97286Medium
The Strong Testimonials plugin (up to version 3.3.11) has a Stored XSS vulnerability due to improper input neutralization during web page generation. An attacker can inject malicious scripts that execute in other users' browsers.
- CVE-2026-92622Medium
The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lightbox_class' Shortcode Attribute in all versions up to, and including, 3.3.8 due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access can inject arbitrary web scripts that execute when a user accesses an injected page.
- CVE-2026-3239Medium
The Strong Testimonials plugin for WordPress versions up to 3.2.21 contains a stored cross-site scripting vulnerability via the testimonial_view shortcode due to insufficient input sanitization and output escaping on user supplied attributes. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts that execute whenever a user accesses an injected page.
Original NVD description (English source)
The Strong Testimonials plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.2.16. This is due to the software allowing users to submit a testimonial in which a value is not properly validated or sanitized prior to being passed to a do_shortcode call. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes if an administrator previews or publishes a crafted testimonial.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS