{"id":"CVE-2026-114706","kind":"vulnerability","aliases":["CVE-2026-114706"],"related":[],"title":"WordPress Strong Testimonials plugin: stored XSS through version 3.3.15","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Testimonials strong-testimonials allows Stored XSS.This issue affects Strong Testimonials: from n/a through 3.3.15.","summary":"The Strong Testimonials WordPress plugin by WP Chill fails to neutralize input, allowing stored cross-site scripting. An attacker who can submit content can run scripts in the browsers of people who view the affected page.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","strong-testimonials","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed Strong Testimonials version in the WordPress admin plugin list or with `wp plugin get strong-testimonials --field=version`\n- Confirm whether the installed version is `3.3.15` or earlier","fix":"- Strong Testimonials: unknown (sources do not state a fixed version)","status":"open","published_at":"2026-10-29T15:17:16+00:00","first_seen_at":"2026-10-29T15:25:38+00:00","triaged_at":"2026-10-29T15:26:40+00:00","updated_at":"2026-10-29T15:26:40+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-29T15:26:40Z","model":"claude-haiku-5-5","output":{"fix":"- Strong Testimonials: unknown (sources do not state a fixed version)","reach":"internet","title":"WordPress Strong Testimonials plugin: stored XSS through version 3.3.15","impact":"medium","summary":"The Strong Testimonials WordPress plugin by WP Chill fails to neutralize input, allowing stored cross-site scripting. An attacker who can submit content can run scripts in the browsers of people who view the affected page.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","strong-testimonials","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Scripts run in visitors' browsers, potentially hijacking admin sessions","analyst_note":"Check the NVD entry and the WordPress plugin changelog for a fixed version and the required privilege to submit the stored input.","how_to_check":"- Check the installed Strong Testimonials version in the WordPress admin plugin list or with `wp plugin get strong-testimonials --field=version`\n- Confirm whether the installed version is `3.3.15` or earlier","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Strong Testimonials WordPress plugin version 3.3.15 or earlier are affected. The sources do not say which user roles can submit the stored input, so exposure depends on who can add or edit testimonials on the site.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000689,"input_tokens":4123,"output_tokens":554,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114706':12A,15A '-2026':11A,14A '3.3.15':9A,92C 'affect':59B,86C 'allow':36B,82C 'attack':43B 'browser':53B 'chill':31B,76C 'content':47B 'cross':39B,70C 'cross-sit':38B,69C 'cve':10A,13A 'fail':32B 'generat':68C 'host':19B 'improp':61C 'input':35B,64C 'issu':85C 'n/a':90C 'neutral':34B,62C 'packag':16B 'page':60B,67C 'peopl':55B 'plugin':4A,28B 'run':49B 'script':41B,50B,72C 'self':18B 'self-host':17B 'site':40B,71C 'store':5A,37B,83C 'strong':2A,21B,25B,77C,80C,87C 'strong-testimoni':20B,79C 'submit':46B 'testimoni':3A,22B,26B,78C,81C,88C 'version':8A 'view':57B 'vulner':73C 'web':66C 'wordpress':1A,23B,27B 'wp':30B,75C 'xss':6A 'xss.this':84C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Strong Testimonials WordPress plugin version 3.3.15 or earlier are affected. The sources do not say which user roles can submit the stored input, so exposure depends on who can add or edit testimonials on the site.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T15:17:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114706","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114706","severity":null,"published_at":"2026-10-29T15:17:16+00:00","modified_at":"2026-10-29T15:18:54+00:00","first_seen_at":"2026-10-29T15:25:38+00:00","fetched_at":"2026-10-29T15:25:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}