What is the CVSS score of CVE-2026-3239?

CVE-2026-3239 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2026-3239

EUVD-2026-20038 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-08 Wordfence

GHSA-5mxp-jr6r-r378

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 08, 2026 - 04:30 euvd

EUVD-2026-20038

Analysis Generated

Apr 08, 2026 - 04:30 vuln.today

CVE Published

Apr 08, 2026 - 04:27 nvd

MEDIUM 6.4

DescriptionCVE.org

The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's testimonial_view shortcode in all versions up to, and including, 3.2.21 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored cross-site scripting in Strong Testimonials WordPress plugin up to version 3.2.21 allows authenticated contributors and above to inject arbitrary JavaScript via the testimonial_view shortcode due to insufficient input sanitization and output escaping. Injected scripts execute in the context of any user viewing the affected page, enabling session hijacking, credential theft, or malware distribution. No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

The vulnerability exists in the testimonial_view shortcode handler within the Strong Testimonials plugin (CPE: cpe:2.3:a:wpchill:strong_testimonials:*:*:*:*:*:*:*:*), which processes user-supplied shortcode attributes without proper sanitization before rendering them to the page output. The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), a common class of XSS vulnerabilities. WordPress shortcodes are a template mechanism that accepts parameters; when these parameters are not escaped before output, an attacker can inject malicious HTML and JavaScript. The vulnerability is classified as stored (persistent) because the malicious payload persists in the WordPress database as part of the page content, affecting all users who view the compromised page rather than just the attacker's session.

RemediationAI

Update the Strong Testimonials plugin immediately to the patched version released after 3.2.21. Check the WordPress plugin repository or Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/88d769cd-bea8-42e4-80a8-a77c0699b50c?source=cve) for the exact fix version number. As a temporary mitigation, restrict contributor-level access to only trusted users and regularly audit published pages and shortcodes for suspicious content. Additionally, implement WordPress security hardening measures such as content security policy (CSP) headers to mitigate stored XSS impact if exploitation occurs before patching.