{"id":"CVE-2026-115811","kind":"vulnerability","aliases":["CVE-2026-115811"],"related":[],"title":"Strong Testimonials WordPress plugin: unauthenticated script injection via star rating","description":"The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'star_rating' parameter in all versions up to, and including, 3.3.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful execution requires an administrator to open the standard Preview link for a pending testimonial, a step the plugin's normal moderation workflow naturally invites.","summary":"The Strong Testimonials WordPress plugin fails to sanitize the 'star_rating' parameter, so anyone can submit a testimonial carrying script code. When an administrator opens the Preview link for that pending testimonial, the script runs in their browser and can act with their admin rights.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"strong-testimonials","fixed":["3.3.17"],"affected":"<= 3.3.16","ecosystem":"wordpress"}],"ecosystems":[],"tags":["package","self-hosted","strong-testimonials","wordpress"],"not_affected_if":["no-public-submissions","plugin-not-installed"],"how_to_check":"- Run `wp plugin get strong-testimonials --field=version`, or look at the Plugins screen in WordPress admin.\n- Versions 3.3.16 and earlier are affected; 3.3.17 or later is patched per Wordfence.\n- Also check pending testimonials in the admin for odd star_rating values or script content before clicking Preview.","fix":"Update Strong Testimonials to 3.3.17 or newer (Wordfence lists 3.3.17 as the patched version).","status":"open","published_at":"2026-11-07T07:17:02+00:00","first_seen_at":"2026-11-07T07:46:06+00:00","triaged_at":"2026-11-07T07:47:05+00:00","updated_at":"2026-11-07T07:48:37+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-07T07:47:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Strong Testimonials WordPress plugin: unauthenticated script injection via star rating","impact":"high","summary":"The Strong Testimonials WordPress plugin fails to sanitize the 'star_rating' parameter, so anyone can submit a testimonial carrying script code. When an administrator opens the Preview link for that pending testimonial, the script runs in their browser and can act with their admin rights.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","strong-testimonials","self-hosted"],"confidence":0.75,"fix_status":"unknown","needs_auth":"no","worst_case":"Admin browser runs attacker script, enabling account takeover on the site","analyst_note":"Find the first fixed version of Strong Testimonials after 3.3.16 in the WordPress.org plugin changelog or the Wordfence advisory for this CVE.","how_to_check":"- Check the installed Strong Testimonials plugin version in the WordPress admin Plugins screen, or with `wp plugin get strong-testimonials --field=version`\n- Compare it against the fixed version; any version up to and including `3.3.16` is affected","plain_action":"","needs_analyst":true,"not_affected_if":["no-public-submissions","plugin-not-installed"],"who_is_affected":"Websites running the Strong Testimonials plugin at version 3.3.16 or earlier that accept testimonial submissions from the public. The attack needs an administrator to open the Preview link of a pending testimonial, so sites that do not accept public submissions face less exposure. The sources do not name a fixed version.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000732,"input_tokens":4315,"output_tokens":601,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the first fixed version of Strong Testimonials after 3.3.16 in the WordPress.org plugin changelog or the Wordfence advisory for this CVE.","search":"'-115811':13A,16A '-2026':12A,15A '3.3.16':99C 'access':128C 'act':68B 'admin':71B 'administr':51B,136C 'anyon':41B 'arbitrari':117C 'attack':114C 'browser':65B 'carri':46B 'code':48B 'cross':84C 'cross-sit':83C 'cve':11A,14A 'due':100C 'escap':107C 'execut':124C,133C 'fail':33B 'host':23B 'includ':98C 'inject':7A,116C,130C 'input':103C 'insuffici':102C 'invit':156C 'link':55B,142C 'make':109C 'moder':153C 'natur':155C 'normal':152C 'open':52B,138C 'output':106C 'packag':20B 'page':121C,131C 'paramet':39B,91C 'pend':58B,145C 'plugin':4A,32B,76C,150C 'possibl':111C 'preview':54B,141C 'rate':10A,38B,90C 'requir':134C 'right':72B 'run':62B 'sanit':35B,104C 'script':6A,47B,61B,86C,119C 'self':22B 'self-host':21B 'site':85C 'standard':140C 'star':9A,37B,89C 'step':148C 'store':82C 'strong':1A,18A,25B,29B,74C 'strong-testimoni':24B 'strong-testimonials':17A 'submit':43B 'success':132C 'testimoni':2A,26B,30B,45B,59B,75C,146C 'testimonials':19A 'unauthent':5A,113C 'user':127C 'version':94C 'via':8A,87C 'vulner':80C 'web':118C 'whenev':125C 'wordpress':3A,27B,31B,78C 'workflow':154C","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running Strong Testimonials 3.3.16 or earlier with a public testimonial submission form. Anyone can submit the payload, but it only runs when an administrator opens the Preview link of the pending testimonial. Sites that do not accept public submissions or do not have the plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["strongtestimonials"],"ptokens":["strong","testimonials"],"labels":["high","package","selfhosted","strongtestimonials","wordpress"],"campaign_type":null,"search_a":"'-115811':13A,16A '-2026':12A,15A 'cve':11A,14A 'inject':7A 'plugin':4A 'rate':10A 'script':6A 'star':9A 'strong':1A,18A 'strong-testimonials':17A 'testimoni':2A 'testimonials':19A 'unauthent':5A 'via':8A 'wordpress':3A","search_b":"'act':68B 'admin':71B 'administr':51B 'anyon':41B 'browser':65B 'carri':46B 'code':48B 'fail':33B 'host':23B 'link':55B 'open':52B 'packag':20B 'paramet':39B 'pend':58B 'plugin':32B 'preview':54B 'rate':38B 'right':72B 'run':62B 'sanit':35B 'script':47B,61B 'self':22B 'self-host':21B 'star':37B 'strong':25B,29B 'strong-testimoni':24B 'submit':43B 'testimoni':26B,30B,45B,59B 'wordpress':27B,31B","search_c":"'3.3.16':99C 'access':128C 'administr':136C 'arbitrari':117C 'attack':114C 'cross':84C 'cross-sit':83C 'due':100C 'escap':107C 'execut':124C,133C 'includ':98C 'inject':116C,130C 'input':103C 'insuffici':102C 'invit':156C 'link':142C 'make':109C 'moder':153C 'natur':155C 'normal':152C 'open':138C 'output':106C 'page':121C,131C 'paramet':91C 'pend':145C 'plugin':76C,150C 'possibl':111C 'preview':141C 'rate':90C 'requir':134C 'sanit':104C 'script':86C,119C 'site':85C 'standard':140C 'star':89C 'step':148C 'store':82C 'strong':74C 'success':132C 'testimoni':75C,146C 'unauthent':113C 'user':127C 'version':94C 'via':87C 'vulner':80C 'web':118C 'whenev':125C 'wordpress':78C 'workflow':154C","first_public_at":"2026-11-07T07:17:02+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115811","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115811","severity":null,"published_at":"2026-11-07T07:17:02+00:00","modified_at":"2026-11-07T07:17:02+00:00","first_seen_at":"2026-11-07T07:46:06+00:00","fetched_at":"2026-11-07T07:46:06+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-115811:2087","url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/strong-testimonials/strong-testimonials-3315-unauthenticated-stored-cross-site-scripting-via-star-rating-parameter","severity":null,"published_at":"2026-11-07T07:48:37+00:00","modified_at":"2026-11-07T07:48:37+00:00","first_seen_at":"2026-11-07T07:48:37+00:00","fetched_at":"2026-11-07T07:48:37+00:00","note":"Wordfence advisory (third party, not the maintainer) gives affected <= 3.3.16, patched 3.3.17. The maintainer's 3.3.17 changelog lists only WPML and styling fixes and does not name this issue, so the fix is not marked verified. No exploitation or PoC found. X not checked.","cites":["https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/strong-testimonials/strong-testimonials-3315-unauthenticated-stored-cross-site-scripting-via-star-rating-parameter","https://plugin-repo.wpbeacon.io/wporg/strong-testimonials/src/branch/trunk/changelog.txt"]}],"documents":[{"id":93988,"url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/strong-testimonials/strong-testimonials-3315-unauthenticated-stored-cross-site-scripting-via-star-rating-parameter","title":"Wordfence: Strong Testimonials <= 3.3.16 Unauthenticated Stored XSS via star_rating","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":93989,"url":"https://plugin-repo.wpbeacon.io/wporg/strong-testimonials/src/branch/trunk/changelog.txt","title":"Strong Testimonials changelog (WP.org mirror)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}