Security Alert Summary
The Strong Testimonials WordPress plugin contains a stored cross-site scripting (XSS) vulnerability in the handling of the star_rating parameter in versions up to and including 3.3.16. Insufficient input sanitization and output escaping allow an unauthenticated attacker to inject script that will execute when an administrator opens the standard Preview link for a pending testimonial.
CVE Details
- CVE ID:
CVE-2026-115811 - Affected component: Strong Testimonials plugin for WordPress
- Affected versions: All versions up to and including 3.3.16
- Published: November 7, 2026 at 7:17:02 AM
- Last modified: November 7, 2026 at 7:17:02 AM
- CVSS v3.1: Base Score 7.2, Severity HIGH, Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N - Authentication / privileges / user interaction: No authentication required; Privileges required: None; User interaction: None
- Primary impact: Confidentiality: Low; Integrity: Low; Availability: None
- Weakness: CWE-79 (Improper Neutralization of Input During Web Page Generation / Cross-site Scripting)
Technical Details
This vulnerability is a stored cross-site scripting (XSS) issue arising from insufficient input sanitization and output escaping of the star_rating parameter. An attacker can submit a crafted testimonial that includes script content in the affected parameter; because the plugin does not properly neutralize or escape that input on output, the injected script is stored and later rendered on pages that display the testimonial.
The CVE description notes that successful script execution occurs when an administrator opens the standard Preview link for a pending testimonial, which is part of the plugin’s normal moderation workflow. The public references point to plugin code in files such as class-strong-testimonials-form.php, class-strong-testimonials-render.php, and class-strong-view-slideshow.php, indicating the areas of the codebase involved in form handling and rendering where sanitization or escaping checks are missing or insufficient.
Impact is limited to what can be achieved via JavaScript executing in the administrator’s browser during preview. The vulnerability does not inherently indicate a direct server-side compromise; it enables client-side script execution that can be used to read or alter data available to the previewing browser or to initiate further social-engineering actions.
How This Could Impact Your Website
Consider a site with a site owner, an internal staff editor who moderates testimonials, and an external contractor or contributor who can submit testimonials. An unauthenticated attacker could submit a testimonial containing malicious script in the star_rating field. When the internal editor or administrator previews a pending testimonial as part of the moderation workflow, the script could run in that users browser context and access data available to the previewing page.
Practical consequences aligned with the CVSS impacts include exposure of data accessible in the administrators browser (for example, visible user information), and an increased risk of targeted phishing or social engineering against staff or contractors if attackers capture emails or session-related data. Availability of the site is not indicated to be affected by this vulnerability.
professional review If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level access.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and administrator actions for unusual behavior, especially the submission and previewing of testimonials.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/strong-testimonials/tags/3.3.15/includes/class-strong-testimonials-form.php#L292
- https://plugins.trac.wordpress.org/browser/strong-testimonials/tags/3.3.15/includes/class-strong-testimonials-render.php#L278
- https://plugins.trac.wordpress.org/browser/strong-testimonials/tags/3.3.15/includes/class-strong-testimonials-render.php#L351
- https://plugins.trac.wordpress.org/browser/strong-testimonials/tags/3.3.15/includes/class-strong-testimonials-render.php#L648
- https://plugins.trac.wordpress.org/browser/strong-testimonials/tags/3.3.15/includes/class-strong-view-slideshow.php#L306
- https://plugins.trac.wordpress.org/browser/strong-testimonials/tags/3.3.15/includes/class-strong-view-slideshow.php#L319
- https://www.wordfence.com/threat-intel/vulnerabilities/id/c35fcd14-b116-40c3-a12b-0183bc0e11f4?source=cve
