Live › vulnerability › CVE-2026-107435
Go to dashboardThe Strong Testimonials WordPress plugin does not neutralize input before generating pages, which allows stored cross-site scripting. An attacker who can submit content can run script in the browser of other visitors or administrators.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Strong Testimonials WordPress plugin at version 3.3.12 or earlier are affected. The sources do not say which input path is stored unsanitized, so whether an unauthenticated visitor can reach it is unknown. Sites that do not run this plugin can skip it.
No product ranges from the sources yet.
wp plugin get strong-testimonials --field=version3.3.12; the exact fixed version is unknown from the sourcesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Testimonials strong-testimonials allows Stored XSS.This issue affects Strong Testimonials: from n/a through 3.3.12.
This page as .md · .json · in your agent: get_signal("CVE-2026-107435")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.