CVE-2025-14426mediumCWE-862

CVE-2025-14426: fallo de gravedad media en wpchill Strong Testimonials

Strong Testimonials <= 3.2.18 - Missing Authorization to Authenticated (Contributor+) Rating Meta Update

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Strong Testimonials

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 4.3epss 0.2%
The Strong Testimonials plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check in the 'edit_rating' function in all versions up to, and including, 3.2.18. This makes it possible for authenticated attackers with Contributor-level access and above to modify or delete the rating meta on any testimonial post, including those created by other users, by reusing a valid nonce obtained from their own testimonial edit screen.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Productos afectados
wpchill · Strong Testimonials
CVEs relacionadas — wpchill Strong Testimonials

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-92622MEDIUMStrong Testimonials <= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lightbox_class' Shortcode AttributeEPSS 0.3%CVE-2025-11268MEDIUMStrong Testimonials <= 3.2.16 - Unauthenticated Arbitrary Shortcode ExecutionEPSS 0.3%CVE-2026-115811HIGHStrong Testimonials <= 3.3.16 - Unauthenticated Stored Cross-Site Scripting via 'star_rating' ParameterEPSS 0.3%CVE-2023-6491MEDIUMStrong Testimonials <= 3.1.12 - Authenticated(Contributor+) Improper Authorization to Views ModificationEPSS 0.3%CVE-2025-7367MEDIUMStrong Testimonials <= 3.2.11 - Authenticated (Author+) Stored Cross-Site Scripting via Custom FieldsEPSS 0.3%CVE-2026-96650HIGHStrong Testimonials <= 3.3.11 - Unauthenticated Stored Cross-Site Scripting via 'platform_user_photo' Custom FieldEPSS 0.3%