The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'platform_user_photo' Custom Field in all versions up to, and including, 3.3.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has added custom text fields named 'platform' and 'platform_user_photo' to a public testimonial submission form, as the plugin does not reserve those internal metadata keys.

zetlyn/cve-nvd vulnerability cve CVE-2026-96650 known 2026-10-03

https://nvd.nist.gov/vuln/detail/CVE-2026-96650

Properties

cvss	7.2 receipt Source NVD Its words `7.2` Read by `field:cve.metrics.cvssMetricV31[].cvssData.baseScore` Said since 2026-10-03 12:09 UTC Last answered 2026-10-04 12:15 UTC Original open at the source What the source handed over { "cve": { "affected": [ { "affectedData": [ { "defaultStatus": "unaffected", "product": "Strong Testimonials", "vendor": "wpchill", "versions": [ { "lessThanOrEqual": "3.3.11", "status": "affected", "version": "0", "versionType": "semver" } ] } ], "source": "security@wordfence.com" } ], "cveTags": [], "descriptions": [ { "lang": "en", "value": "The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'platform_user_photo' Custom Field in all versions up to, and including, 3.3.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has added custom text fields named 'platform' and 'platform_user_photo' to a public testimonial submission form, as the plugin does not reserve those internal metadata keys." } ], "id": "CVE-2026-96650", "lastModified": "2026-10-03T06:16:48.290", "metrics": { "cvssMetricV31": [ { "cvssData": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "version": "3.1" }, "exploitabilityScore": 3.9, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Primary" } ] }, "published": "2026-10-03T06:16:48.290", "references": [ { "source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/strong-testimonials/tags/3.3.10/includes/class-strong-testimonials-form.php#L260" }, { "source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/strong-testimonials/tags/3.3.10/includes/class-strong-testimonials-form.php#L32" }, { "source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/strong-testimonials/tags/3.3.10/includes/functions-image.php#L242" }, { "source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/strong-testimonials/tags/3.3.10/includes/functions-image.php#L275" }, { "source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3711376%40strong-testimonials&new=3711376%40strong-testimonials" }, { "source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/73c8267c-8c03-4ee6-9d3e-e383188b82ad?source=cve" } ], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Received", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-79" } ], "source": "security@wordfence.com", "type": "Primary" } ] } }
product	Strong Testimonials receipt Source NVD Its words `Strong Testimonials` Read by `field:cve.affected[].affectedData[].product` Said since 2026-10-03 12:09 UTC Last answered 2026-10-04 12:15 UTC Original open at the source What the source handed over { "cve": { "affected": [ { "affectedData": [ { "defaultStatus": "unaffected", "product": "Strong Testimonials", "vendor": "wpchill", "versions": [ { "lessThanOrEqual": "3.3.11", "status": "affected", "version": "0", "versionType": "semver" } ] } ], "source": "security@wordfence.com" } ], "cveTags": [], "descriptions": [ { "lang": "en", "value": "The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'platform_user_photo' Custom Field in all versions up to, and including, 3.3.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has added custom text fields named 'platform' and 'platform_user_photo' to a public testimonial submission form, as the plugin does not reserve those internal metadata keys." } ], "id": "CVE-2026-96650", "lastModified": "2026-10-03T06:16:48.290", "metrics": { "cvssMetricV31": [ { "cvssData": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "version": "3.1" }, "exploitabilityScore": 3.9, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Primary" } ] }, "published": "2026-10-03T06:16:48.290", "references": [ { "source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/strong-testimonials/tags/3.3.10/includes/class-strong-testimonials-form.php#L260" }, { "source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/strong-testimonials/tags/3.3.10/includes/class-strong-testimonials-form.php#L32" }, { "source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/strong-testimonials/tags/3.3.10/includes/functions-image.php#L242" }, { "source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/strong-testimonials/tags/3.3.10/includes/functions-image.php#L275" }, { "source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3711376%40strong-testimonials&new=3711376%40strong-testimonials" }, { "source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/73c8267c-8c03-4ee6-9d3e-e383188b82ad?source=cve" } ], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Received", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-79" } ], "source": "security@wordfence.com", "type": "Primary" } ] } }
status	Received receipt Source NVD Its words `Received` Read by `field:cve.vulnStatus` Said since 2026-10-03 12:09 UTC Last answered 2026-10-04 12:15 UTC Original open at the source What the source handed over { "cve": { "affected": [ { "affectedData": [ { "defaultStatus": "unaffected", "product": "Strong Testimonials", "vendor": "wpchill", "versions": [ { "lessThanOrEqual": "3.3.11", "status": "affected", "version": "0", "versionType": "semver" } ] } ], "source": "security@wordfence.com" } ], "cveTags": [], "descriptions": [ { "lang": "en", "value": "The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'platform_user_photo' Custom Field in all versions up to, and including, 3.3.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has added custom text fields named 'platform' and 'platform_user_photo' to a public testimonial submission form, as the plugin does not reserve those internal metadata keys." } ], "id": "CVE-2026-96650", "lastModified": "2026-10-03T06:16:48.290", "metrics": { "cvssMetricV31": [ { "cvssData": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "version": "3.1" }, "exploitabilityScore": 3.9, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Primary" } ] }, "published": "2026-10-03T06:16:48.290", "references": [ { "source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/strong-testimonials/tags/3.3.10/includes/class-strong-testimonials-form.php#L260" }, { "source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/strong-testimonials/tags/3.3.10/includes/class-strong-testimonials-form.php#L32" }, { "source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/strong-testimonials/tags/3.3.10/includes/functions-image.php#L242" }, { "source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/strong-testimonials/tags/3.3.10/includes/functions-image.php#L275" }, { "source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3711376%40strong-testimonials&new=3711376%40strong-testimonials" }, { "source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/73c8267c-8c03-4ee6-9d3e-e383188b82ad?source=cve" } ], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Received", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-79" } ], "source": "security@wordfence.com", "type": "Primary" } ] } }
vendor	wpchill receipt Source NVD Its words `wpchill` Read by `field:cve.affected[].affectedData[].vendor` Said since 2026-10-03 12:09 UTC Last answered 2026-10-04 12:15 UTC Original open at the source What the source handed over { "cve": { "affected": [ { "affectedData": [ { "defaultStatus": "unaffected", "product": "Strong Testimonials", "vendor": "wpchill", "versions": [ { "lessThanOrEqual": "3.3.11", "status": "affected", "version": "0", "versionType": "semver" } ] } ], "source": "security@wordfence.com" } ], "cveTags": [], "descriptions": [ { "lang": "en", "value": "The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'platform_user_photo' Custom Field in all versions up to, and including, 3.3.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has added custom text fields named 'platform' and 'platform_user_photo' to a public testimonial submission form, as the plugin does not reserve those internal metadata keys." } ], "id": "CVE-2026-96650", "lastModified": "2026-10-03T06:16:48.290", "metrics": { "cvssMetricV31": [ { "cvssData": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "version": "3.1" }, "exploitabilityScore": 3.9, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Primary" } ] }, "published": "2026-10-03T06:16:48.290", "references": [ { "source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/strong-testimonials/tags/3.3.10/includes/class-strong-testimonials-form.php#L260" }, { "source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/strong-testimonials/tags/3.3.10/includes/class-strong-testimonials-form.php#L32" }, { "source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/strong-testimonials/tags/3.3.10/includes/functions-image.php#L242" }, { "source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/strong-testimonials/tags/3.3.10/includes/functions-image.php#L275" }, { "source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3711376%40strong-testimonials&new=3711376%40strong-testimonials" }, { "source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/73c8267c-8c03-4ee6-9d3e-e383188b82ad?source=cve" } ], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Received", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-79" } ], "source": "security@wordfence.com", "type": "Primary" } ] } }

Text

The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'platform_user_photo' Custom Field in all versions up to, and including, 3.3.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has added custom text fields named 'platform' and 'platform_user_photo' to a public testimonial submission form, as the plugin does not reserve those internal metadata keys.