{"id":"CVE-2026-107435","kind":"vulnerability","aliases":["CVE-2026-107435"],"related":[],"title":"WordPress Strong Testimonials plugin: stored XSS through version 3.3.12","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Testimonials strong-testimonials allows Stored XSS.This issue affects Strong Testimonials: from n/a through 3.3.12.","summary":"The Strong Testimonials WordPress plugin does not neutralize input before generating pages, which allows stored cross-site scripting. An attacker who can submit content can run script in the browser of other visitors or administrators.","severity":"high","cvss":7.1,"epss":0.00146,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed Strong Testimonials plugin version in the WordPress admin under Plugins, or with `wp plugin get strong-testimonials --field=version`\n- Compare the result with the fixed version, which the sources do not state: unknown","fix":"- Update the Strong Testimonials plugin to a version later than `3.3.12`; the exact fixed version is unknown from the sources\n- Until updated, restrict who can submit or edit testimonials","status":"open","published_at":"2026-10-21T08:16:41+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T03:31:56+00:00","updated_at":"2026-10-25T03:31:56+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:31:56Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Strong Testimonials plugin to a version later than `3.3.12`; the exact fixed version is unknown from the sources\n- Until updated, restrict who can submit or edit testimonials","reach":"internet","title":"WordPress Strong Testimonials plugin: stored XSS through version 3.3.12","impact":"medium","summary":"The Strong Testimonials WordPress plugin does not neutralize input before generating pages, which allows stored cross-site scripting. An attacker who can submit content can run script in the browser of other visitors or administrators.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker script runs in visitors' and administrators' browsers on the site.","analyst_note":"Find the fixed version and the vulnerable input path in the NVD entry or the plugin changelog for Strong Testimonials.","how_to_check":"- Check the installed Strong Testimonials plugin version in the WordPress admin under Plugins, or with `wp plugin get strong-testimonials --field=version`\n- Compare the result with the fixed version, which the sources do not state: unknown","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Strong Testimonials WordPress plugin at version 3.3.12 or earlier are affected. The sources do not say which input path is stored unsanitized, so whether an unauthenticated visitor can reach it is unknown. Sites that do not run this plugin can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00063,"input_tokens":3354,"output_tokens":589,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-107435':12A,15A '-2026':11A,14A '3.3.12':9A,91C 'administr':59B 'affect':85C 'allow':37B,81C 'attack':44B 'browser':54B 'chill':75C 'content':48B 'cross':40B,69C 'cross-sit':39B,68C 'cve':10A,13A 'generat':34B,67C 'host':19B 'improp':60C 'input':32B,63C 'issu':84C 'n/a':89C 'neutral':31B,61C 'packag':16B 'page':35B,66C 'plugin':4A,23B,28B 'run':50B 'script':42B,51B,71C 'self':18B 'self-host':17B 'site':41B,70C 'store':5A,38B,82C 'strong':2A,25B,76C,79C,86C 'strong-testimoni':78C 'submit':47B 'testimoni':3A,26B,77C,80C,87C 'version':8A 'visitor':57B 'vulner':72C 'web':65C 'wordpress':1A,20B,22B,27B 'wordpress-plugin':21B 'wp':74C 'xss':6A 'xss.this':83C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Strong Testimonials WordPress plugin at version 3.3.12 or earlier are affected. The sources do not say which input path is stored unsanitized, so whether an unauthenticated visitor can reach it is unknown. Sites that do not run this plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T08:16:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107435","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107435","severity":null,"published_at":"2026-10-21T08:16:41+00:00","modified_at":"2026-10-21T14:26:26+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-107435","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107435","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}