CVE-2026-97286: WordPress Strong Testimonials plugin <= 3.3.11 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Testimonials strong-testimonials allows Stored XSS.This issue affects Strong Testimonials: from n/a through 3.3.11.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Strong Testimonials (strong-testimonials)to a version that resolves this vulnerability.Fixed in 3.3.12
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The vulnerability is described as contributor XSS, so an attacker needs contributor-level access to the affected WordPress site.
Does exploitation require a victim to take an action?
Yes. The CVSS vector includes UI:R, indicating user interaction is required for exploitation.
Can this be exploited remotely?
Yes. The CVSS vector includes AV:N, meaning the vulnerable site can be targeted over the network, provided the attacker has the required contributor-level privileges.