CVE-2026-92622: Strong Testimonials <= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lightbox_class' Shortcode Attribute
The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lightboxclass' Shortcode Attribute in all versions up to, and including, 3.3.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the targeted testimonial view has at least one published testimonial with a featured image and the lightbox wrapper enabled, as the vulnerable code path is only reached when a thumbnail is rendered.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Strong Testimonials pluginto a version that resolves this vulnerability.Fixed in 3.3.8 - Compensating control
Ensure the targeted testimonial view does not render featured images with the lightbox wrapper enabled (i.e., disable the lightbox wrapper on testimonial views) to prevent reaching the vulnerable code path when thumbnails are rendered.
Event History
Frequently Asked Questions
Which sites are exposed to exploitation?
Sites using Strong Testimonials version 3.3.8 or earlier are exposed if attackers can obtain Contributor-level or higher WordPress access. The vulnerable rendering path also requires a targeted testimonial view with at least one published testimonial that has a featured image and has the lightbox wrapper enabled.
What access does an attacker need?
An attacker must be authenticated to WordPress with at least Contributor-level permissions. No user interaction is needed for injection, but the injected script executes when someone visits the affected page.
How can I determine whether a testimonial view can trigger the issue?
Check whether the view contains a published testimonial with a featured image and whether the lightbox wrapper is enabled. If no thumbnail is rendered, the described vulnerable code path is not reached.