---
id: "CVE-2026-115811"
page: "https://infrastack.ai/live/CVE-2026-115811"
kind: "vulnerability"
aliases: ["CVE-2026-115811"]
title: "Strong Testimonials WordPress plugin: unauthenticated script injection via star rating"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "strong-testimonials", "fixed": ["3.3.17"], "affected": "<= 3.3.16", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["package", "self-hosted", "strong-testimonials", "wordpress"]
not_affected_if: ["no-public-submissions", "plugin-not-installed"]
published_at: "2026-11-07T07:17:02+00:00"
first_seen_at: "2026-11-07T07:46:06+00:00"
updated_at: "2026-11-07T07:48:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115811", "first_seen_at": "2026-11-07T07:46:06+00:00"}, {"source": "analyst", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/strong-testimonials/strong-testimonials-3315-unauthenticated-stored-cross-site-scripting-via-star-rating-parameter", "first_seen_at": "2026-11-07T07:48:37+00:00", "cites": ["https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/strong-testimonials/strong-testimonials-3315-unauthenticated-stored-cross-site-scripting-via-star-rating-parameter", "https://plugin-repo.wpbeacon.io/wporg/strong-testimonials/src/branch/trunk/changelog.txt"]}]
exploit_sources: []
---

# Strong Testimonials WordPress plugin: unauthenticated script injection via star rating

Link for people: https://infrastack.ai/live/CVE-2026-115811 (this .md is for agents)

The Strong Testimonials WordPress plugin fails to sanitize the 'star_rating' parameter, so anyone can submit a testimonial carrying script code. When an administrator opens the Preview link for that pending testimonial, the script runs in their browser and can act with their admin rights.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:strong-testimonials affected <= 3.3.16 fixed 3.3.17

## How to check

- Run `wp plugin get strong-testimonials --field=version`, or look at the Plugins screen in WordPress admin.
- Versions 3.3.16 and earlier are affected; 3.3.17 or later is patched per Wordfence.
- Also check pending testimonials in the admin for odd star_rating values or script content before clicking Preview.

## Fix

Update Strong Testimonials to 3.3.17 or newer (Wordfence lists 3.3.17 as the patched version).

## Timeline

- 2026-11-07T07:46:06+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115811
- 2026-11-07T07:48:37+00:00 analyst https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/strong-testimonials/strong-testimonials-3315-unauthenticated-stored-cross-site-scripting-via-star-rating-parameter — Wordfence advisory (third party, not the maintainer) gives affected <= 3.3.16, patched 3.3.17. The maintainer's 3.3.17 changelog lists only WPML and styling fixes and does not name this issue, so the fix is not marked verified. No exploitation or PoC found. X not checked.

## Documents

- [advisory] Wordfence: Strong Testimonials <= 3.3.16 Unauthenticated Stored XSS via star_rating https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/strong-testimonials/strong-testimonials-3315-unauthenticated-stored-cross-site-scripting-via-star-rating-parameter
- [fix] Strong Testimonials changelog (WP.org mirror) https://plugin-repo.wpbeacon.io/wporg/strong-testimonials/src/branch/trunk/changelog.txt

## From the sources

The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'star_rating' parameter in all versions up to, and including, 3.3.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful execution requires an administrator to open the standard Preview link for a pending testimonial, a step the plugin's normal moderation workflow naturally invites.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_