{
 "id": "WPSEC-2026-0907",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0907/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0907/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0907/index.md",
 "title": "Strong Testimonials <= 3.3.12 - Unauthenticated HTML Injection via Comments",
 "description": "The Strong Testimonials plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 3.3.12. This is due to the plugin's wp_kses_allowed_html filter adding iframe, style, noscript, form-control (input, textarea, select, option, optgroup) and data-* attributes to every kses context, including the comment context, instead of only its own. This makes it possible for unauthenticated attackers to inject iframes, arbitrary CSS and form elements into comments, and into other content filtered by kses such as testimonial fields, which are then shown to site visitors and administrators.",
 "plugin": {
  "slug": "strong-testimonials",
  "name": "Strong Testimonials",
  "full_name": "Strong Testimonials",
  "wordpress_org": "https://wordpress.org/plugins/strong-testimonials/",
  "advisories_url": "https://wpsec.com/vuln/plugin/strong-testimonials/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/strong-testimonials"
 },
 "type": "CONTENT INJECTION",
 "cwe": [
  "CWE-80"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.3.13",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.3.13"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.3.13",
 "remediation": "Update to 3.3.13 or later.",
 "fix_released": "2026-10-13T13:01:13+00:00",
 "published": "2026-10-14T13:49:25+00:00",
 "updated": "2026-10-14T12:18:16.659960+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0907/",
  "https://plugins.svn.wordpress.org/strong-testimonials/tags/3.3.13/",
  "https://wordpress.org/plugins/strong-testimonials/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/strong-testimonials",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-14"
 }
}