Strong Testimonials CVE-2026-114706

Exploitation requires an authenticated account with at least low-level privileges on the WordPress site capable of submitting testimonial content to the Strong Testimonials plugin (consistent with PR:L), plus subsequent user interaction (UI:R) - a victim such as an administrator must view the page rendering the stored, improperly neutralized input for the script to execute. The precise injectable field and the exact capability threshold are not detailed in the available sources. Limiting factors that reduce real-world risk: the need for a pre-existing authenticated (non-anonymous) account, the dependency on a victim viewing the stored content, and the requirement that the vulnerable plugin (version ≤3.3.15) be installed and active. There is no indication in the input that any non-default configuration is required.

This is a stored (persistent) cross-site scripting flaw (CWE-79) in the Strong Testimonials WordPress plugin, versions through 3.3.15, with a CVSS 3.1 base score of 6.5 (vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). The signals point to a moderate, not emergency, priority. The vector indicates network reach and low attack complexity, but it is NOT unauthenticated: PR:L means the attacker needs at least a low-privileged authenticated account, and UI:R means a victim (typically an administrator or other user) must view the injected content for the payload to fire. The scope-change flag (S:C) reflects that the injected script executes in the victim's browser context rather than only the vulnerable component, which is standard for stored XSS. No EPSS probability was supplied in the input, there is no CISA KEV listing, and no verified public exploit code is present - only a Patchstack database advisory reference. The vuln.today decision label is 'this_month', consistent with a real but non-urgent issue rather than an actively exploited critical bug. Net: a genuine issue worth patching on a normal monthly cycle, not a drop-everything emergency, with the authentication and user-interaction requirements meaningfully limiting mass exploitation. Note the absence of an EPSS score in the input - exploitation probability could not be quantified from the data provided.

A low-privileged authenticated user (for example a contributor-level account able to submit testimonial content) injects a malicious JavaScript payload into a testimonial field that the plugin fails to properly neutralize. The payload is stored and later rendered when an administrator or other user views the affected page, executing the attacker's script in that victim's browser session. No verified public exploit code is present in the input - only a Patchstack advisory reference - so exploitation would require an attacker to craft the payload themselves.