WP Chill Strong Testimonials: Cross-site scripting via content injection

Summary

The WordPress plugin Strong Testimonials up to and including version 3.3.17 contains a cross-site scripting (XSS) vulnerability that allows script-related HTML to be injected into pages. An unauthenticated remote attacker can add unwanted content to affected pages, such as ads, scam or malware links, without a login or user interaction. The sources do not describe the exact injection point, so the exposure depends on where testimonials are displayed on a site.

Affected

• Strong Testimonials (WordPress plugin, WP Chill) versions 0 through 3.3.17
• Unaffected from version 3.3.18

Fixed in

• Upgrade Strong Testimonials to version 3.3.18 or later
• The vendor changelog entry for 3.3.18 could not be confirmed.

Workaround

• Unknown. The injection point is not described in the sources, so no mitigation without a patch can be stated.

Exploitation

• Not known to be exploited.
• Not listed in CISA KEV.
• CISA SSVC: exploitation none, automatable yes, technical impact partial.
• No public proof of concept found; the CVE was published on 2026-11-11.

Our recommendation

• Identify all WordPress sites running Strong Testimonials and their versions.
• Update the plugin to 3.3.18 or later and verify the installed version afterwards.
• Review testimonial content and submission form fields for injected script or unwanted links.
• Monitor the Patchstack advisory and NVD for updates.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE Record CVE-2026-121028 www.cve.org
• Patchstack advisory patchstack.com
• OffSeq threat radar radar.offseq.com
• Strix AI CVE page www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 17:51.