Strong Testimonials CVE-2026-97286

Requires an authenticated WordPress account with at least Contributor-level privileges on a site running the Strong Testimonials plugin version 3.3.11 or earlier (PR:L). Exploitation further depends on user interaction (UI:R): a victim - typically an administrator or another user - must view the page or admin screen where the attacker-supplied content is rendered for the injected script to fire. These two limiters (a valid low-privilege account plus a victim viewing the content) substantially narrow realistic exploitation compared to an unauthenticated, no-interaction flaw, even though the attack vector is network-based.

This is a moderate-severity, low-real-world-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, 6.5) describes a network-reachable stored/reflected XSS that nonetheless requires an authenticated account (PR:L, consistent with the 'Contributor' role named in the description) and victim interaction (UI:R). The scope change (S:C) reflects script executing in the browser under the site's origin against another user, but all impacts are Low. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The single source is a Patchstack database entry - a reputable but sole feed - and the description is sparse, naming neither the vulnerable parameter nor the sink. The signals are internally consistent (no CVSS-vs-description conflict): a network vector gated by a real authentication requirement and user interaction points to a genuine but lower-tier issue best handled through routine patching rather than emergency response.

An attacker who has obtained or been granted a low-privileged Contributor account on a WordPress site running Strong Testimonials <= 3.3.11 submits a testimonial or field containing a malicious script payload. When an administrator or another user later views the affected content in the dashboard or front end, the script executes in their browser session under the site's origin, enabling session/cookie theft or admin-context actions. No public proof-of-concept is available, and exploitation requires the victim to view the injected content.