CVE-2026-97286
MediumCVSS 6.5Summary
The Strong Testimonials plugin in versions up to and including 3.3.11 contains a Cross Site Scripting (XSS) vulnerability exploitable by a user with Contributor privileges. This allows injection of a malicious script into the site.
Risk Assessment
A low-privileged user can execute malicious code in other users' browsers, potentially leading to session theft or content modification.
Recommendation
Update the Strong Testimonials plugin to a version later than 3.3.11 to eliminate the XSS vulnerability.
Other vulnerabilities in Strong Testimonials
See all- CVE-2026-92622Medium
The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lightbox_class' Shortcode Attribute in all versions up to, and including, 3.3.8 due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access can inject arbitrary web scripts that execute when a user accesses an injected page.
- CVE-2026-3239Medium
The Strong Testimonials plugin for WordPress versions up to 3.2.21 contains a stored cross-site scripting vulnerability via the testimonial_view shortcode due to insufficient input sanitization and output escaping on user supplied attributes. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts that execute whenever a user accesses an injected page.
Original NVD description (English source)
Contributor Cross Site Scripting (XSS) in Strong Testimonials <= 3.3.11 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS