STRONG-TESTIMONIALS · CVE-2026-115811 · Package
FIX → 3.3.17
The Strong Testimonials WordPress plugin fails to sanitize the 'star_rating' parameter, so anyone can submit a testimonial carrying script code. When an administrator opens the Preview link for that pending testimonial, the script runs in their browser and can act with their admin rights.
first public Nov 7, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
WordPress sites running Strong Testimonials 3.3.16 or earlier with a public testimonial submission form. Anyone can submit the payload, but it only runs when an administrator opens the Preview link of the pending testimonial. Sites that do not accept public submissions or do not have the plugin can skip it.
Not affected if no-public-submissions, plugin-not-installed
Who cares self-hosted, strong-testimonials, wordpress
wp plugin get strong-testimonials --field=version, or look at the Plugins screen in WordPress admin.Upgrade to 3.3.17
Update Strong Testimonials to 3.3.17 or newer (Wordfence lists 3.3.17 as the patched version).
The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'star_rating' parameter in all versions up to, and including, 3.3.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful execution requires an administrator to open the standard Preview link for a pending testimonial, a step the plugin's normal moderation workflow naturally invites.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.