HomeWordPress vulnerabilitiesStrong Testimonials
Strong Testimonials vulnerabilities
Strong Testimonials has 11 known vulnerabilities in this database. The most recent published record is dated 3 Oct 2026.
- Known vulnerabilities
- 11
- Active installs
- 80,000+
- Latest version
- 3.3.12
- Last updated
- 24 Sep 2026
- Most recent
- 3 Oct 2026
Find it in your WordPress dashboard under Plugins. Severity is based on the CVSS score published with the CVE where one is available.
| Vulnerability | Severity | Affected | Fix | Published |
|---|---|---|---|---|
| Cross-site scripting (XSS) CVE-2026-96650 | High 7.2 | Up to 3.3.11 | Fixed in a later version (latest 3.3.12) | 4 d ago |
| Cross-site scripting (XSS) CVE-2026-97286 | Medium 6.5 | Up to 3.3.11 | Fixed in a later version (latest 3.3.12) | 7 d ago |
| Cross-site scripting (XSS) CVE-2026-92622 | Medium 6.4 | Up to 3.3.8 | Fixed in a later version (latest 3.3.12) | 18 Sep 2026 |
| Cross-site scripting (XSS) CVE-2026-3239 | Medium 6.4 | Up to 3.2.21 | Fixed in a later version (latest 3.3.12) | 8 Apr 2026 |
| Broken access control CVE-2025-14426 | Medium 4.3 | Up to 3.2.18 | Fixed in a later version (latest 3.3.12) | 30 Dec 2025 |
| Cross-site scripting (XSS) CVE-2025-11268 | Medium 4.3 | Up to 3.2.16 | Fixed in a later version (latest 3.3.12) | 6 Nov 2025 |
| Cross-site scripting (XSS) CVE-2025-7367 | Medium 6.4 | Up to 3.2.11 | Fixed in a later version (latest 3.3.12) | 15 Jul 2025 |
| Broken access control CVE-2023-6491 | Medium 4.3 | Before 3.1.13 | Fixed in 3.1.13 | 7 Jun 2024 |
| Cross-site scripting (XSS) CVE-2024-3261 | Medium 4.8 | Before 3.1.12 | Fixed in 3.1.12 | 24 Apr 2024 |
| Cross-site scripting (XSS) CVE-2022-4717 | Medium 5.4 | Before 3.0.3 | Fixed in 3.0.3 | 6 Feb 2023 |
| Cross-site scripting (XSS) CVE-2020-8549 | Medium 6.1 | Before 2.40.1 | Fixed in 2.40.1 | 3 Feb 2020 |
Read the published descriptions
- CVE-2026-96650, 3 Oct 2026
- The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'platform_user_photo' Custom Field in all versions up to, and including, 3.3.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has added custom text fields named 'platform' and 'platform_user_photo' to a public testimonial submission form, as the plugin does not reserve those internal metadata keys. CVE record
- CVE-2026-97286, 30 Sep 2026
- Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Testimonials strong-testimonials allows Stored XSS.This issue affects Strong Testimonials: from n/a through 3.3.11. CVE record
- CVE-2026-92622, 18 Sep 2026
- The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lightbox_class' Shortcode Attribute in all versions up to, and including, 3.3.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the targeted testimonial view has at least one published testimonial with a featured image and the lightbox wrapper enabled, as the vulnerable code path is only reached when a thumbnail is rendered. CVE record
- CVE-2026-3239, 8 Apr 2026
- The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's testimonial_view shortcode in all versions up to, and including, 3.2.21 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE record
- CVE-2025-14426, 30 Dec 2025
- The Strong Testimonials plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check in the 'edit_rating' function in all versions up to, and including, 3.2.18. This makes it possible for authenticated attackers with Contributor-level access and above to modify or delete the rating meta on any testimonial post, including those created by other users, by reusing a valid nonce obtained from their own testimonial edit screen. CVE record
- CVE-2025-11268, 6 Nov 2025
- The Strong Testimonials plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.2.16. This is due to the software allowing users to submit a testimonial in which a value is not properly validated or sanitized prior to being passed to a do_shortcode call. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes if an administrator previews or publishes a crafted testimonial. CVE record
- CVE-2025-7367, 15 Jul 2025
- The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Testimonial Custom Fields in all versions up to, and including, 3.2.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE record
- CVE-2023-6491, 7 Jun 2024
- The Strong Testimonials plugin for WordPress is vulnerable to unauthorized modification of data due to an improper capability check on the wpmtst_save_view_sticky function in all versions up to, and including, 3.1.12. This makes it possible for authenticated attackers, with contributor access and above, to modify favorite views. CVE record
- CVE-2024-3261, 24 Apr 2024
- The Strong Testimonials WordPress plugin before 3.1.12 does not validate and escape some of its Testimonial fields before outputting them back in a page/post, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. The attack requires a specific view to be performed CVE record
- CVE-2022-4717, 6 Feb 2023
- The Strong Testimonials WordPress plugin before 3.0.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. CVE record
- CVE-2020-8549, 3 Feb 2020
- Stored XSS in the Strong Testimonials plugin before 2.40.1 for WordPress can result in an attacker performing malicious actions such as stealing session tokens. CVE record
What to do if you run Strong Testimonials
If you run Strong Testimonials, open WordPress and check the installed version in Plugins. Compare it with the affected versions in the vulnerability record. If a fixed version is available, take a current backup and update to that version or the latest supported release.
If no fixed version exists, consider disabling and removing the plugin or replacing it with a maintained alternative. After dealing with the affected software, check administrator users, unexpected file changes, redirects, unfamiliar pages and security logs for signs that the site may already have been altered.
Email me about new Strong Testimonials vulnerabilities
Free. We email you when a new vulnerability is published for Strong Testimonials, usually within minutes. Confirm by email; unsubscribe any time.
Focus on your business. We’ll take care of your website.
From everyday updates to ongoing care, we keep your website working.