Strong Testimonials CVE-2026-96650

Exploitation is NOT possible against a default installation. It requires that a site administrator has added custom text fields with the exact internal keys 'platform' and 'platform_user_photo' to a PUBLIC (unauthenticated) testimonial submission form, because the plugin does not reserve these metadata keys - this specific misconfiguration is the enabling precondition. Given that, an unauthenticated attacker (CVSS PR:N) can submit the payload remotely. The limiting factors are: the uncommon custom-field naming requirement, the need for the submission form to be publicly accessible, and that the stored script only fires when a user subsequently loads the page rendering the injected testimonial. Affected versions are all releases up to and including 3.3.11.

This is a stored XSS (CWE-79) in the Strong Testimonials WordPress plugin rated CVSS 7.2 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N - network attack vector, low complexity, no privileges, with a changed scope reflecting that injected script executes in the browser of whoever views the affected page. The signals are mixed: the CVSS PR:N implies an unauthenticated attacker, but the description imposes a significant real-world precondition - an administrator must have manually added custom text fields literally named 'platform' and 'platform_user_photo' to a PUBLIC testimonial submission form, because the plugin fails to reserve those internal metadata keys. That non-default, operator-dependent requirement materially lowers the realistic AC:L rating and means this is far from a spray-and-pray flaw. No EPSS score, CISA KEV entry, or public POC was supplied in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net assessment: a legitimate but CONDITIONAL stored-XSS requiring an uncommon field configuration, not a top-tier priority despite the 7.2/'High' label; prioritize patching where the plugin is used with custom submission-form fields, but it does not warrant emergency response absent those conditions.

On a site where an admin has added public custom fields named 'platform' and 'platform_user_photo' to the testimonial submission form, an unauthenticated attacker submits a testimonial containing a malicious script payload in the 'platform_user_photo' field. Because the plugin neither sanitizes input nor escapes output for this metadata key, the script is stored and later executes in the browser of any visitor or administrator who views the page rendering that testimonial. No public exploit code was identified in the provided data.