rootpwn

high · CVSS v3 7.2 · EPSS 0.00255

CVE-2026-96650

The Strong Testimonials WordPress plugin is vulnerable to stored XSS via the 'platform_user_photo' custom field in all versions up to 3.3.11

Overview

The Strong Testimonials WordPress plugin is vulnerable to stored XSS via the 'platform_user_photo' custom field in all versions up to 3.3.11. Unauthenticated attackers can inject scripts that execute when users view a testimonial page, enabling defacement or credential theft. This flaw can compromise site integrity and user confidentiality.

Description

The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'platform_user_photo' Custom Field in all versions up to, and including, 3.3.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has added custom text fields named 'platform' and 'platform_user_photo' to a public testimonial submission form, as the plugin does not reserve those internal metadata keys.

Impact

Confidentiality: attackers can steal user data via injected scripts. Integrity: site content can be altered. Availability: minimal impact. Defenders: WordPress site admins and developers.

Remediation

Update the Strong Testimonials plugin to version 3.3.12 or later. If an update is not possible, remove or rename the custom fields 'platform' and 'platform_user_photo' from testimonial forms, or implement server‑side sanitization/escaping for these fields. Deploy a web application firewall rule to block XSS payloads targeting testimonial pages.

Risk context

High severity CVE with a low EPSS of 0.00255 indicates a rare but serious vulnerability. Defenders should prioritize patching within the next 30 days to mitigate potential exploitation.

Affected products

  • Strong Testimonials WP plugin v3.3.11
  • Strong Testimonials WP plugin v3.3.10
  • Strong Testimonials WP plugin v3.3.9
  • Strong Testimonials WP plugin v3.3.8
  • Strong Testimonials WP plugin v3.3.7
  • Strong Testimonials WP plugin v3.3.6
  • Strong Testimonials WP plugin v3.3.5
  • Strong Testimonials WP plugin v3.3.4

Scores

Severity
high
CVSS v2
6.4
CVSS v3
7.2
CVSS v4
—
EPSS
0.00255

wordpress xss stored-xss plugin strong-testimonials wp-admin web-application defense

← All CVEs

Related CVEs

high

CVE-2026-88782

The Kubio AI Page Builder WordPress plugin (v<2.9.3) fails to validate URI schemes in user-supplied link targets, enabling stored XSS. Contributors and higher can inject malicious payloads that execute in the browsers of anyone who clicks the link, including administrators previewing drafts. This flaw can lead to session hijacking or defacement.

View analysis

high

CVE-2026-97935

A use‑after‑free bug in the Linux kernel tracing subsystem allows a malformed histogram trigger to corrupt the named_triggers list. The flaw occurs when an invalid clock string is supplied, causing the trigger to be registered before the clock is validated. This can lead to kernel memory corruption and potential privilege escalation.

View analysis

high

CVE-2026-104912

MISP before v2.5.48 has an authorization flaw in correlation handling during attribute searches. Correlated attributes and events can be authorized using a stale distribution snapshot instead of the live event access control list. This matters because restricted or unpublished events may remain visible to authenticated users who no longer have permission.

View analysis

high

CVE-2026-94544

CVE-2026-94544 exposes a cache sharing flaw in Next.js 16.3.0‑16.3.8 that allows unauthenticated users to see unpublished draft content or see published content in draft mode. The vulnerability arises when Cache Components or experimental.useCache are enabled and cached functions return draft‑dependent data. It can lead to accidental disclosure of sensitive content on public sites.

View analysis