Strong Testimonials
Approved changes feed: RSS · Atom
cpe:2.3:a:wpchill:strong_testimonials:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Wpchill (229d438d-d20e-586d-ac2f-e6b4e123f9dc) |
|---|---|
| Product | Strong Testimonials (610164d5-9d13-5bbd-a0ac-8f57807bf278) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/wpchill/strong-testimonials |
purl2cpe | 2026-06-01 10:12:17.937806 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-3239 |
vulnerable | 2026-06-08 08:01:18.256778 |
Strong Testimonials <= 3.2.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via testimonial_view Shortcode
MEDIUM (6.4)
The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's testimonial_view shortcode in all versions up to, and including, 3.2.21 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Published: 2026-04-08T04:27:16.978Z
Updated: 2026-04-08T17:05:19.972Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-7367 |
vulnerable | 2026-06-08 07:43:18.414985 |
Strong Testimonials <= 3.2.11 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Fields
MEDIUM (6.4)
The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Testimonial Custom Fields in all versions up to, and including, 3.2.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Published: 2025-07-15T04:23:41.525Z
Updated: 2026-04-08T16:57:45.025Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-14426 |
vulnerable | 2026-06-08 07:06:34.427989 |
Strong Testimonials <= 3.2.18 - Missing Authorization to Authenticated (Contributor+) Rating Meta Update
MEDIUM (4.3)
The Strong Testimonials plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check in the 'edit_rating' function in all versions up to, and including, 3.2.18. This makes it possible for authenticated attackers with Contributor-level access and above to modify or delete the rating meta on any testimonial post, including those created by other users, by reusing a valid nonce obtained from their own testimonial edit screen.
Published: 2025-12-30T12:22:35.514Z
Updated: 2026-04-08T17:21:32.717Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-11268 |
vulnerable | 2026-06-08 07:02:28.514020 |
Strong Testimonials <= 3.2.16 - Unauthenticated Arbitrary Shortcode Execution
MEDIUM (4.3)
The Strong Testimonials plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.2.16. This is due to the software allowing users to submit a testimonial in which a value is not properly validated or sanitized prior to being passed to a do_shortcode call. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes if an administrator previews or publishes a crafted testimonial.
Published: 2025-11-06T08:26:27.860Z
Updated: 2026-04-08T17:23:38.359Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-47362 |
vulnerable | 2026-06-08 06:48:11.852188 |
WordPress Strong Testimonials plugin <= 3.1.16 - Broken Access Control vulnerability
MEDIUM (4.3)
Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials.This issue affects Strong Testimonials: from n/a through <= 3.1.16.
Published: 2024-11-01T14:17:01.952Z
Updated: 2026-04-28T16:10:19.706Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-6491 |
vulnerable | 2026-06-08 06:19:47.469673 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-52123 |
vulnerable | 2026-06-08 06:17:54.299806 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-26013 |
vulnerable | 2026-06-08 05:57:37.807725 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.