# Strong Testimonials <= 3.3.12 - Unauthenticated HTML Injection via Comments

- **ID:** WPSEC-2026-0907
- **Plugin:** Strong Testimonials (`strong-testimonials`), https://wordpress.org/plugins/strong-testimonials/
- **Affected versions:** all versions before 3.3.13
- **Fixed in:** 3.3.13 (Update to 3.3.13 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-80
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-14)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/strong-testimonials
- **Fix released:** 2026-10-13
- **Published:** 2026-10-14
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0907/

## Description

The Strong Testimonials plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 3.3.12. This is due to the plugin's wp_kses_allowed_html filter adding iframe, style, noscript, form-control (input, textarea, select, option, optgroup) and data-* attributes to every kses context, including the comment context, instead of only its own. This makes it possible for unauthenticated attackers to inject iframes, arbitrary CSS and form elements into comments, and into other content filtered by kses such as testimonial fields, which are then shown to site visitors and administrators.

## References

- https://wpsec.com/vuln/WPSEC-2026-0907/
- https://plugins.svn.wordpress.org/strong-testimonials/tags/3.3.13/
- https://wordpress.org/plugins/strong-testimonials/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0907/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.