4.3
Medium
CVE-2025-11268 The Strong Testimonials plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and…
Description
The Strong Testimonials plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.2.16. This is due to the software allowing users to submit a testimonial in which a value is not properly validated or sanitized prior to being passed to a do_shortcode call. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes if an administrator previews or publishes a crafted testimonial.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Strong Testimonials 3.2 | earliest → 3.2.16 | No fix stated |
Other CVEs of Strong Testimonials
The 10 CVEs of Strong Testimonials →
CVE-2026-96650
The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'platform_user_photo'…
7.2
High
CVE-2026-92622
The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lightbox_class' Shortcode…
6.4
Medium
CVE-2026-3239
The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's…
6.4
Medium
CVE-2025-14426
The Strong Testimonials plugin for WordPress is vulnerable to unauthorized modification of data due to a missing…
4.3
Medium