Is CVE-2026-121028 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-121028 being exploited in the wild.

How severe is CVE-2026-121028?

Medium severity, with a CVSS score of 5.3, published 11 November 2026.

Which products and versions are affected?

WP Chill Strong Testimonials through 3.3.17.

Is there a fix for CVE-2026-121028?

Yes: fixed in 3.3.18. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-121028 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-121028?

Check whether you run WP Chill Strong Testimonials at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-121028: WP Chill Strong Testimonials XSS in content injection

CVE-2026-121028 · Severity: medium · CVSS 5.3 · Published 2026-11-11

Strong Testimonials is a WordPress plugin that allows website owners to collect and display customer testimonials. The plugin contains a cross-site scripting (XSS) vulnerability that permits attackers to inject malicious scripts into web pages, potentially leading to defacement, credential theft, or distribution of malware to site visitors without requiring authentication.

Technologies: WP Chill Strong Testimonials. Vendors: WP Chill.

Quick answers

Is CVE-2026-121028 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-121028 being exploited in the wild.
How severe is CVE-2026-121028?: Medium severity, with a CVSS score of 5.3, published 11 November 2026.
Which products and versions are affected?: WP Chill Strong Testimonials through 3.3.17.
Is there a fix for CVE-2026-121028?: Yes: fixed in 3.3.18. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-121028 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-121028?: Check whether you run WP Chill Strong Testimonials at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 3.3.18

Technical details

The plugin fails to properly sanitize user-supplied input, allowing improper neutralization of script-related HTML tags. An unauthenticated attacker can inject arbitrary HTML and JavaScript into affected pages via the content injection vector, resulting in code execution within the context of the website and visitor browsers. The vulnerability affects all versions through 3.3.17.

Affected products

WP Chill Strong Testimonials through 3.3.17

Timeline

2026-10-30: disclosed: Reported to Patchstack
2026-11-11: advisory: Published by Patchstack

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.