CVE-2026-92622mediumCWE-79

CVE-2026-92622: fallo de gravedad media en wpchill Strong Testimonials

Strong Testimonials <= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lightbox_class' Shortcode Attribute

Publicada el

Seguir esta CVE+ Monitorear Strong Testimonials

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.4epss 0.3%
The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lightbox_class' Shortcode Attribute in all versions up to, and including, 3.3.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the targeted testimonial view has at least one published testimonial with a featured image and the lightbox wrapper enabled, as the vulnerable code path is only reached when a thumbnail is rendered.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Productos afectados
wpchill · Strong Testimonials
CVEs relacionadas — wpchill Strong Testimonials

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-11268MEDIUMStrong Testimonials <= 3.2.16 - Unauthenticated Arbitrary Shortcode ExecutionEPSS 0.3%CVE-2026-115811HIGHStrong Testimonials <= 3.3.16 - Unauthenticated Stored Cross-Site Scripting via 'star_rating' ParameterEPSS 0.3%CVE-2023-6491MEDIUMStrong Testimonials <= 3.1.12 - Authenticated(Contributor+) Improper Authorization to Views ModificationEPSS 0.3%CVE-2025-7367MEDIUMStrong Testimonials <= 3.2.11 - Authenticated (Author+) Stored Cross-Site Scripting via Custom FieldsEPSS 0.3%CVE-2026-96650HIGHStrong Testimonials <= 3.3.11 - Unauthenticated Stored Cross-Site Scripting via 'platform_user_photo' Custom FieldEPSS 0.3%CVE-2025-14426MEDIUMStrong Testimonials <= 3.2.18 - Missing Authorization to Authenticated (Contributor+) Rating Meta UpdateEPSS 0.2%