Strong Testimonials
Monthly
Stored cross-site scripting in the Strong Testimonials WordPress plugin through version 3.3.12 allows an attacker to place a script payload in testimonial content that executes when a victim views the rendered testimonial, potentially in an administrative or page-rendering context. This is a moderate-priority issue: exploitation depends on a victim viewing the stored content and on whether testimonial submission is reachable by low-privileged users; under the assessed vector the attacker needs at least low-privileged authenticated access, though a public front-end submission configuration can lower that barrier. No public exploit code or confirmed active exploitation was identified at time of analysis.
Stored cross-site scripting in the Strong Testimonials WordPress plugin (all versions through 3.3.11) can let unauthenticated attackers inject scripts that execute in visitors' browsers when an affected testimonial page is loaded, but only if an administrator has created custom text fields with the exact internal keys 'platform' and 'platform_user_photo' on a public testimonial submission form. The plugin fails to sanitize and escape those custom-field values (CWE-79), so default installations are not exploitable; the independent assessment notes attack complexity is High because that uncommon field configuration and public form are required. The provided CVSS is 7.2 with changed scope for browser-side execution, and no public exploit was identified at time of analysis.
Stored cross-site scripting in the WP Chill Strong Testimonials WordPress plugin, affecting all versions through 3.3.15, lets an authenticated low-privilege user submit testimonial content that is rendered without proper neutralization, so script executes in the browser of any user - including an administrator - who views the affected page. The assessed CVSS 3.1 base score is 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), reflecting the need for a pre-existing account and for victim interaction, while the scope change means the injected script can act beyond the plugin's own component. No CISA KEV entry, public exploit reference or EPSS score was supplied in the available intelligence, so there is no public exploit identified at time of analysis; the vendor-facing reference is the Patchstack advisory for the 3.3.15 release.
Authenticated attackers holding only low-privilege WordPress accounts can abuse improperly enforced access controls in the WP Chill Strong Testimonials plugin (all versions through 3.3.12) to perform testimonial-management actions they are not authorized to carry out, producing limited integrity and availability impact without disclosure of sensitive data. The flaw is a CWE-862 missing authorization condition rated CVSS 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L): network-reachable and requiring no user interaction, but gated behind an existing account at PR:L, so sites that disable open registration or tightly control subscriber-level accounts are materially less exposed. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the sole public reference is the Patchstack advisory, and no vendor fix version is specified in the available data.
Missing authorization checks in the WP Chill Strong Testimonials WordPress plugin through version 3.3.12 allow an attacker who already holds a valid low-privilege account (CVSS PR:L, so network-reachable but authenticated) to invoke plugin functionality that lacks a proper capability check and read data they should not be able to access. Impact is confined to limited confidentiality loss - no integrity or availability effect, and no unauthenticated path - making this a low-to-moderate priority issue; the realistic prerequisite is open/self-service registration or an already-compromised subscriber-level credential. No public exploit code or confirmed active exploitation was identified at time of analysis.
Cross-site scripting in the Strong Testimonials WordPress plugin (versions through 3.3.11) lets an authenticated attacker with Contributor-level privileges on a WordPress site inject content that executes as script when a victim-typically an administrator or editor-views the affected page or admin screen. Exploitation requires both a valid low-privilege account and victim interaction, which materially narrows real-world risk; no public exploit was identified at time of analysis and no CISA KEV listing or EPSS signal accompanies this CVE. The result is a moderate-severity, low-priority issue whose main danger is privilege escalation or session abuse against higher-privileged users on multi-author sites.
Authenticated attackers with contributor-level access can inject persistent JavaScript into WordPress sites running Strong Testimonials 3.3.8 or earlier through the 'lightbox_class' shortcode attribute, due to insufficient input sanitization and output escaping. Exploitation requires that the targeted testimonial view has at least one published testimonial with a featured image and the lightbox wrapper enabled, because the vulnerable code path is only reached when a thumbnail is rendered; the stored script then executes automatically when any user views the injected page. No public exploit code or active exploitation has been identified, and the CVSS score of 6.4 reflects a scope change with low confidentiality and integrity impact.
Stored cross-site scripting in Strong Testimonials WordPress plugin up to version 3.2.21 allows authenticated contributors and above to inject arbitrary JavaScript via the testimonial_view shortcode due to insufficient input sanitization and output escaping. Injected scripts execute in the context of any user viewing the affected page, enabling session hijacking, credential theft, or malware distribution. No public exploit code or active exploitation has been identified at time of analysis.
Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials.1.16. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Strong Testimonials plugin for WordPress is vulnerable to unauthorized modification of data due to an improper capability check on the wpmtst_save_view_sticky function in all versions up to, and. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Strong Testimonials WordPress plugin before 3.1.12 does not validate and escape some of its Testimonial fields before outputting them back in a page/post, which could allow users with the. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in WPChill Strong Testimonials.1.10. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Stored XSS in the Strong Testimonials plugin before 2.40.1 for WordPress can result in an attacker performing malicious actions such as stealing session tokens. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Stored cross-site scripting in the Strong Testimonials WordPress plugin through version 3.3.12 allows an attacker to place a script payload in testimonial content that executes when a victim views the rendered testimonial, potentially in an administrative or page-rendering context. This is a moderate-priority issue: exploitation depends on a victim viewing the stored content and on whether testimonial submission is reachable by low-privileged users; under the assessed vector the attacker needs at least low-privileged authenticated access, though a public front-end submission configuration can lower that barrier. No public exploit code or confirmed active exploitation was identified at time of analysis.
Stored cross-site scripting in the Strong Testimonials WordPress plugin (all versions through 3.3.11) can let unauthenticated attackers inject scripts that execute in visitors' browsers when an affected testimonial page is loaded, but only if an administrator has created custom text fields with the exact internal keys 'platform' and 'platform_user_photo' on a public testimonial submission form. The plugin fails to sanitize and escape those custom-field values (CWE-79), so default installations are not exploitable; the independent assessment notes attack complexity is High because that uncommon field configuration and public form are required. The provided CVSS is 7.2 with changed scope for browser-side execution, and no public exploit was identified at time of analysis.
Stored cross-site scripting in the WP Chill Strong Testimonials WordPress plugin, affecting all versions through 3.3.15, lets an authenticated low-privilege user submit testimonial content that is rendered without proper neutralization, so script executes in the browser of any user - including an administrator - who views the affected page. The assessed CVSS 3.1 base score is 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), reflecting the need for a pre-existing account and for victim interaction, while the scope change means the injected script can act beyond the plugin's own component. No CISA KEV entry, public exploit reference or EPSS score was supplied in the available intelligence, so there is no public exploit identified at time of analysis; the vendor-facing reference is the Patchstack advisory for the 3.3.15 release.
Authenticated attackers holding only low-privilege WordPress accounts can abuse improperly enforced access controls in the WP Chill Strong Testimonials plugin (all versions through 3.3.12) to perform testimonial-management actions they are not authorized to carry out, producing limited integrity and availability impact without disclosure of sensitive data. The flaw is a CWE-862 missing authorization condition rated CVSS 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L): network-reachable and requiring no user interaction, but gated behind an existing account at PR:L, so sites that disable open registration or tightly control subscriber-level accounts are materially less exposed. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the sole public reference is the Patchstack advisory, and no vendor fix version is specified in the available data.
Missing authorization checks in the WP Chill Strong Testimonials WordPress plugin through version 3.3.12 allow an attacker who already holds a valid low-privilege account (CVSS PR:L, so network-reachable but authenticated) to invoke plugin functionality that lacks a proper capability check and read data they should not be able to access. Impact is confined to limited confidentiality loss - no integrity or availability effect, and no unauthenticated path - making this a low-to-moderate priority issue; the realistic prerequisite is open/self-service registration or an already-compromised subscriber-level credential. No public exploit code or confirmed active exploitation was identified at time of analysis.
Cross-site scripting in the Strong Testimonials WordPress plugin (versions through 3.3.11) lets an authenticated attacker with Contributor-level privileges on a WordPress site inject content that executes as script when a victim-typically an administrator or editor-views the affected page or admin screen. Exploitation requires both a valid low-privilege account and victim interaction, which materially narrows real-world risk; no public exploit was identified at time of analysis and no CISA KEV listing or EPSS signal accompanies this CVE. The result is a moderate-severity, low-priority issue whose main danger is privilege escalation or session abuse against higher-privileged users on multi-author sites.
Authenticated attackers with contributor-level access can inject persistent JavaScript into WordPress sites running Strong Testimonials 3.3.8 or earlier through the 'lightbox_class' shortcode attribute, due to insufficient input sanitization and output escaping. Exploitation requires that the targeted testimonial view has at least one published testimonial with a featured image and the lightbox wrapper enabled, because the vulnerable code path is only reached when a thumbnail is rendered; the stored script then executes automatically when any user views the injected page. No public exploit code or active exploitation has been identified, and the CVSS score of 6.4 reflects a scope change with low confidentiality and integrity impact.
Stored cross-site scripting in Strong Testimonials WordPress plugin up to version 3.2.21 allows authenticated contributors and above to inject arbitrary JavaScript via the testimonial_view shortcode due to insufficient input sanitization and output escaping. Injected scripts execute in the context of any user viewing the affected page, enabling session hijacking, credential theft, or malware distribution. No public exploit code or active exploitation has been identified at time of analysis.
Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials.1.16. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Strong Testimonials plugin for WordPress is vulnerable to unauthorized modification of data due to an improper capability check on the wpmtst_save_view_sticky function in all versions up to, and. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Strong Testimonials WordPress plugin before 3.1.12 does not validate and escape some of its Testimonial fields before outputting them back in a page/post, which could allow users with the. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in WPChill Strong Testimonials.1.10. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Stored XSS in the Strong Testimonials plugin before 2.40.1 for WordPress can result in an attacker performing malicious actions such as stealing session tokens. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.