Strong Testimonials <= 3.3.12 - Unauthenticated HTML Injection via Comments
- ID
- WPSEC-2026-0907
- Plugin
- Strong Testimonials (strong-testimonials)
- Affected
- all versions before 3.3.13
- Remediation
- Update to 3.3.13 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
- Weakness
- CWE-80
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-14
- Attack surface
- Strong Testimonials on WPSec AttackSurface
- Fix released
- Published
Description
The Strong Testimonials plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 3.3.12. This is due to the plugin's wp_kses_allowed_html filter adding iframe, style, noscript, form-control (input, textarea, select, option, optgroup) and data-* attributes to every kses context, including the comment context, instead of only its own. This makes it possible for unauthenticated attackers to inject iframes, arbitrary CSS and form elements into comments, and into other content filtered by kses such as testimonial fields, which are then shown to site visitors and administrators.
References
- https://wpsec.com/vuln/WPSEC-2026-0907/
- https://plugins.svn.wordpress.org/strong-testimonials/tags/3.3.13/
- https://wordpress.org/plugins/strong-testimonials/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS