CVE-2026-107435: WordPress Strong Testimonials plugin <= 3.3.12 - Cross Site Scripting (XSS) vulnerability
Published Oct 21, 2026
·Updated
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Testimonials strong-testimonials allows Stored XSS.This issue affects Strong Testimonials: from n/a through 3.3.12.
Affected Software
1 affected component
WP Chill Strong Testimonials<=3.3.12
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/strong-testimonialsto a version that resolves this vulnerability.Fixed in 3.3.13
Event History
Oct 21, 2026
CVE Published
via MITRE·08:00 AM
Data Sourced
via MITRE·08:00 AM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
Does exploitation require an authenticated WordPress account?
No. The CVSS vector indicates no privileges are required for exploitation.
2
Can this be exploited remotely, and is user interaction needed?
The issue is network-accessible and has low attack complexity. However, exploitation requires user interaction; the available data does not specify the form that interaction takes.
3
What is the potential impact if exploitation succeeds?
The CVSS vector indicates low impacts to confidentiality, integrity, and availability, with a changed scope.