Strong Testimonials EUVD-2026-107136

Exploitation requires the attacker to get a script payload stored through Strong Testimonials' testimonial input (submission form or editable testimonial field) and then requires a victim to view the rendered testimonial (UI:R), typically in an administrative or page-rendering context. The practical precondition is whether testimonial submission is reachable by the attacker's privilege level: if the plugin's front-end testimonial submission is enabled and open to the public, exploitation is effectively unauthenticated (consistent with PR:N); if submission is restricted to logged-in roles, the attacker needs at least that authenticated role, which limits exploitation. The scope change (S:C) reflects impact on the victim's browser session rather than the server. Limiting factors: dependence on a victim viewing the stored content, and the actual configuration of who may submit testimonials.

This is a moderate-priority issue, not a top-tier emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, score 7.1) reflects network-reachable, low-complexity Stored XSS with scope change, but the PR:N rating conflicts with how most WordPress testimonial-submission flows work - stored XSS of this type usually requires at least an authenticated low-privilege account OR a publicly-exposed front-end submission form, so PR:N should be treated as condition-dependent rather than confirmed. No EPSS score, KEV listing, or POC was provided in the intelligence, and there is no public exploit identified at time of analysis, which argues against imminent mass exploitation. The dominant real-world risk driver is therefore prevalence of the plugin plus the realistic ease of getting a payload stored and later rendered in a privileged (e.g. admin) context, not a confirmed exploitation signal. Net: a legitimate patch-soon item for sites running the affected plugin, but absent KEV/POC/EPSS data it does not rise to drop-everything urgency; verify the actual submission path (public vs authenticated) against your configuration before weighting the PR:N assumption.

An attacker submits a testimonial (or edits a testimonial field) containing a malicious script payload that is stored by Strong Testimonials and not properly neutralized on output. When an administrator or other user later views the testimonial in the dashboard or on a page, the script executes in their browser session, enabling session/cookie theft or actions in the victim's authenticated context. No public exploit code was identified in the provided data.