CVE-2026-110371
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
The Strong Testimonials plugin by WP Chill contains a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects Strong Testimonials from n/a through 3.3.12.
Risk Assessment
An attacker may perform actions they should not be permitted to, because access control is insufficient. This can lead to unauthorized modification or disclosure of data.
Recommendation
Update the Strong Testimonials plugin to a version later than 3.3.12. Review user role permissions and restrict access to administrative functions.
Other vulnerabilities in Strong Testimonials
See all- CVE-2026-109897Medium
The WordPress plugin 'Strong Testimonials' (versions up to 3.3.12) contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels.
- CVE-2026-96650High
The Strong Testimonials plugin for WordPress is vulnerable to stored cross-site scripting via the 'platform_user_photo' custom field in versions up to and including 3.3.11. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. Exploitation requires an administrator to have added custom text fields 'platform' and 'platform_user_photo' to a public testimonial submission form.
- CVE-2026-97286Medium
The Strong Testimonials plugin (up to version 3.3.11) has a Stored XSS vulnerability due to improper input neutralization during web page generation. An attacker can inject malicious scripts that execute in other users' browsers.
- CVE-2026-92622Medium
The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lightbox_class' Shortcode Attribute in all versions up to, and including, 3.3.8 due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access can inject arbitrary web scripts that execute when a user accesses an injected page.
- CVE-2026-3239Medium
The Strong Testimonials plugin for WordPress versions up to 3.2.21 contains a stored cross-site scripting vulnerability via the testimonial_view shortcode due to insufficient input sanitization and output escaping on user supplied attributes. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts that execute whenever a user accesses an injected page.
- CVE-2025-11268Medium
The Strong Testimonials plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to and including 3.2.16. This is due to the software allowing users to submit a testimonial in which a value is not properly validated or sanitized prior to being passed to a do_shortcode call. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes if an administrator previews or publishes a crafted testimonial.
Original NVD description (English source)
Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Strong Testimonials: from n/a through 3.3.12.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS