Executive brief
The Strong Testimonials WordPress plugin fails to properly sanitize user input in the lightbox_class shortcode attribute, allowing authenticated contributors to inject malicious scripts into pages. When a page with an injected shortcode is viewed by other users, the malicious script executes in their browser, potentially stealing session credentials or redirecting users to malicious sites. This vulnerability only manifests when a featured testimonial image is displayed with the lightbox feature enabled.
Technical details
The vulnerability is a Stored Cross-Site Scripting (XSS) flaw in the Strong Testimonials plugin's shortcode rendering logic, specifically in the handling of the 'lightbox_class' attribute. Insufficient input sanitization and output escaping allow authenticated users with contributor-level access to embed arbitrary JavaScript in the attribute value. The attack vector is network-based and requires authentication plus specific trigger conditions: the targeted testimonial view must have at least one published testimonial with a featured image and the lightbox wrapper enabled. An attacker can achieve persistent code execution that affects all users viewing the injected page. Patches are expected to address this in versions after 3.3.8.
Affected products
- WordPress.org Strong Testimonials up to and including 3.3.8
Timeline
- 2026-09-18: disclosed: CVE-2026-92622 published