CVE-2026-96650

Name of the Vulnerable Software and Affected Versions Strong Testimonials versions prior to 3.3.12

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute when a user accesses them. This issue is exploitable if an administrator has added custom text fields named platform and platform user photo to a public testimonial submission form, as the plugin fails to reserve these internal metadata keys.

Recommendations Update Strong Testimonials to version 3.3.12 or later. Avoid using the platform user photo custom field in public testimonial submission forms until the update is applied.