CVE-2026-92622

Name of the Vulnerable Software and Affected Versions Strong Testimonials versions prior to 3.3.9

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages via the lightbox class shortcode attribute. These scripts execute when a user visits the affected page. This issue is triggered only when a testimonial view contains at least one published testimonial with a featured image and the lightbox wrapper enabled, as the flaw is located in the thumbnail rendering process.

Recommendations Update Strong Testimonials to version 3.3.9 or later.