CVE-2026-92622
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lightbox_class' Shortcode Attribute in all versions up to, and including, 3.3.8 due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access can inject arbitrary web scripts that execute when a user accesses an injected page.
Risk Assessment
A contributor-level attacker can inject malicious scripts that execute for visitors, leading to session theft or content tampering. Exploitation requires a published testimonial with a featured image and the lightbox wrapper enabled.
Recommendation
Update the Strong Testimonials plugin to a version later than 3.3.8. Restrict contributor privileges and review content before publishing.
Other vulnerabilities in Strong Testimonials
See all- CVE-2026-97286Medium
The Strong Testimonials plugin in versions up to and including 3.3.11 contains a Cross Site Scripting (XSS) vulnerability exploitable by a user with Contributor privileges. This allows injection of a malicious script into the site.
- CVE-2026-3239Medium
The Strong Testimonials plugin for WordPress versions up to 3.2.21 contains a stored cross-site scripting vulnerability via the testimonial_view shortcode due to insufficient input sanitization and output escaping on user supplied attributes. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts that execute whenever a user accesses an injected page.
Original NVD description (English source)
The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lightbox_class' Shortcode Attribute in all versions up to, and including, 3.3.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the targeted testimonial view has at least one published testimonial with a featured image and the lightbox wrapper enabled, as the vulnerable code path is only reached when a thumbnail is rendered.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS