CVE-2026-96650: Strong Testimonials <= 3.3.11 - Unauthenticated Stored Cross-Site Scripting via 'platform_user_photo' Custom Field
The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'platformuserphoto' Custom Field in all versions up to, and including, 3.3.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has added custom text fields named 'platform' and 'platformuserphoto' to a public testimonial submission form, as the plugin does not reserve those internal metadata keys.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Sites running Strong Testimonials 3.3.11 or earlier are exposed only if an administrator added custom text fields named "platform" and "platform_user_photo" to a public testimonial submission form. The attacker does not need to authenticate.
What does an attacker need to do to exploit this issue?
An attacker needs access to the affected public testimonial submission form and must submit malicious script content through the "platform_user_photo" custom field. The script executes when another user accesses a page containing the injected testimonial.
Are default testimonial submission forms affected?
The issue requires administrator-created custom text fields with the specific names "platform" and "platform_user_photo". The provided information does not indicate that those fields are present by default.
How can I check whether my site may be affected?
Verify the installed Strong Testimonials version and review public testimonial submission forms for custom text fields named "platform" and "platform_user_photo". Also inspect submitted testimonials and pages displaying them for unexpected or malicious content in the affected field.