CVE-2026-121028: WordPress Strong Testimonials plugin <= 3.3.17 - Content Injection vulnerability
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WP Chill Strong Testimonials strong-testimonials allows Code Injection.This issue affects Strong Testimonials: from n/a through 3.3.17.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
strong-testimonialsto a version that resolves this vulnerability.Fixed in 3.3.18
Event History
Frequently Asked Questions
Which installations are affected?
Strong Testimonials versions through 3.3.17 are affected. The available data does not identify a lower fixed starting version or any unaffected configuration.
Does exploiting this issue require authentication or user interaction?
No. The CVSS vector lists PR:N and UI:N, indicating that the vulnerability can be exploited without prior privileges and without requiring a victim to perform an action.
What is the potential impact of successful exploitation?
The issue is classified as basic cross-site scripting/content injection. The CVSS vector indicates low confidentiality impact and no integrity or availability impact.