CVE-2025-11268: medium-severity vulnerability in wpchill Strong Testimonials
Strong Testimonials <= 3.2.16 - Unauthenticated Arbitrary Shortcode Execution
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.3epss 0.3%
The Strong Testimonials plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.2.16. This is due to the software allowing users to submit a testimonial in which a value is not properly validated or sanitized prior to being passed to a do_shortcode call. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes if an administrator previews or publishes a crafted testimonial.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Affected products
wpchill · Strong TestimonialsRelated CVEs — wpchill Strong Testimonials
In the same product, most dangerous first.
CVE-2026-92622MEDIUMStrong Testimonials <= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lightbox_class' Shortcode AttributeEPSS 0.3%CVE-2026-115811HIGHStrong Testimonials <= 3.3.16 - Unauthenticated Stored Cross-Site Scripting via 'star_rating' ParameterEPSS 0.3%CVE-2023-6491MEDIUMStrong Testimonials <= 3.1.12 - Authenticated(Contributor+) Improper Authorization to Views ModificationEPSS 0.3%CVE-2025-7367MEDIUMStrong Testimonials <= 3.2.11 - Authenticated (Author+) Stored Cross-Site Scripting via Custom FieldsEPSS 0.3%CVE-2026-96650HIGHStrong Testimonials <= 3.3.11 - Unauthenticated Stored Cross-Site Scripting via 'platform_user_photo' Custom FieldEPSS 0.3%CVE-2025-14426MEDIUMStrong Testimonials <= 3.2.18 - Missing Authorization to Authenticated (Contributor+) Rating Meta UpdateEPSS 0.2%