Strong Testimonials CVE-2026-92622

Requires an authenticated WordPress account with contributor-level access or above (PR:L) on a site running Strong Testimonials <=3.3.8. Exploitation is further constrained: the targeted testimonial view must contain at least one published testimonial that has a featured image AND have the lightbox wrapper enabled, because the vulnerable 'lightbox_class' output path is only reached when a thumbnail is rendered. No end-user interaction beyond a victim loading the injected page (UI:N); the stored script fires automatically when the thumbnail renders. These role and configuration prerequisites meaningfully limit real-world exploitability despite the network attack vector.

This is a genuine-but-modest-severity issue, not a top-tier priority. The CVSS 6.4 (Medium) reflects the real profile: network-reachable (AV:N) and low-complexity (AC:L), but gated behind contributor-level authentication (PR:L) and a scope change (S:C) with only Low confidentiality and integrity impact (C:L/I:L) - consistent with stored XSS that runs in a victim's browser rather than server-side compromise. No EPSS score, no CISA KEV listing, and no public POC are present in the provided intelligence, so exploitation status is 'no public exploit identified at time of analysis.' Wordfence reporting plus a concrete fix changeset (3699887) and vulnerable source lines confirm the flaw is real and patched. The practical risk is further limited by the requirement that the targeted testimonial view actually render a thumbnail (published testimonial + featured image + lightbox wrapper enabled), which narrows the exploitable surface. Net: a legitimate stored-XSS bug worth patching promptly on affected sites, but there is no signal of widespread or active exploitation.

A malicious or compromised contributor-level user on a WordPress site running Strong Testimonials <=3.3.8 injects a script payload into the 'lightbox_class' shortcode attribute of a testimonial view that has a published testimonial with a featured image and the lightbox wrapper enabled. When any visitor or administrator loads a page that renders the thumbnail, the unsanitized attribute executes attacker JavaScript in their browser session. No public exploit code was identified at time of analysis, but the attribute-injection path is straightforward for anyone with the required role.