CVE-2025-7367: Strong Testimonials WordPress XSS Vulnerability

CVE-2025-7367 Overview

CVE-2025-7367 is a stored cross-site scripting (XSS) vulnerability in the Strong Testimonials plugin for WordPress. The flaw affects all versions up to and including 3.2.11. The issue stems from insufficient input sanitization and output escaping in the Testimonial Custom Fields feature. Authenticated users with Author-level access or higher can inject arbitrary JavaScript that executes when any visitor loads an affected page. The weakness is tracked under CWE-79.

Critical Impact

Authenticated attackers with Author privileges can inject persistent JavaScript that executes in the browsers of site visitors and administrators, enabling session theft, administrative action abuse, and content defacement.

Affected Products

• Strong Testimonials plugin for WordPress — all versions through 3.2.11
• WordPress sites allowing Author-level or higher user registration
• Any site rendering testimonials containing attacker-controlled custom field values

Discovery Timeline

• 2025-07-15 - CVE-2025-7367 published to the National Vulnerability Database
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-7367

Vulnerability Analysis

The Strong Testimonials plugin exposes Testimonial Custom Fields that accept user-supplied values. The plugin fails to sanitize these inputs on write and fails to escape them on render. As a result, raw HTML and JavaScript supplied by an authenticated contributor are stored in the database and later emitted directly into page output. Any user whose browser renders the affected page executes the attacker-controlled script in the site's origin.

Because the payload is persistent, it executes repeatedly across every visitor and administrator who views the page. Scope is marked as changed because the injected script runs under the WordPress site origin, affecting components beyond the vulnerable plugin itself.

Root Cause

The vulnerable code paths reside in the plugin's template helpers. See line 317 and line 532 of functions-template.php in the 3.2.11 tag. These functions render custom field values without applying esc_html(), esc_attr(), or wp_kses(). The plugin trusts the authenticated role boundary and treats custom field content as safe markup rather than untrusted input.

Attack Vector

An attacker first obtains Author-level access or above, either through legitimate registration on sites that permit it or through credential compromise. The attacker creates or edits a testimonial and places a JavaScript payload into a custom field value. When any user loads a page displaying that testimonial, the stored payload executes in their session context. Payloads can exfiltrate authentication cookies, trigger administrative REST API calls, or deliver secondary web-based payloads. See the Wordfence vulnerability report for additional technical context.

Detection Methods for CVE-2025-7367

Indicators of Compromise

• Testimonial custom field values containing <script>, onerror=, onload=, javascript:, or encoded script fragments
• New or modified testimonial posts authored by low-privilege accounts shortly before suspicious administrative activity
• Outbound requests from administrator browsers to unfamiliar domains after loading pages that render testimonials
• Unexpected creation of new Administrator accounts or changes to plugin and theme files

Detection Strategies

• Query the WordPress database for testimonial post meta containing script tags or inline event handlers
• Review audit logs for Author-role accounts creating or editing testimonials outside normal patterns
• Monitor web server access logs for requests to admin endpoints originating from browser sessions that just rendered testimonial pages
• Scan rendered HTML output of testimonial-bearing pages for unescaped user-controlled markup

Monitoring Recommendations

• Enable WordPress activity logging covering post, user, and plugin events, and forward logs to centralized storage
• Alert on creation of new administrator accounts and on modifications to privileged user roles
• Track plugin version inventory across WordPress estates to identify hosts still running Strong Testimonials 3.2.11 or earlier
• Correlate testimonial edits by non-Editor roles with subsequent privileged actions in the same session window

How to Mitigate CVE-2025-7367

Immediate Actions Required

• Update the Strong Testimonials plugin to a version later than 3.2.11 as soon as a patched release is available from the plugin vendor
• Audit all existing testimonials and custom field values for script content and remove malicious entries
• Review Author-level and higher accounts, disable unused accounts, and rotate credentials for any suspected compromise
• Rotate WordPress session tokens and administrator passwords if stored XSS payloads were discovered

Patch Information

No fixed version is listed in the NVD entry at time of writing. Monitor the Strong Testimonials plugin page and the Wordfence advisory for release notes. Apply the vendor patch across all WordPress installations once published and verify the plugin version post-upgrade.

Workarounds

• Restrict Author-level and higher registration, and require administrator approval for role elevation
• Disable the Strong Testimonials plugin until a patched version is installed if testimonials are not business-critical
• Deploy a web application firewall rule that blocks requests containing script tags or event-handler attributes in testimonial submission parameters
• Apply a Content Security Policy that disallows inline script execution on pages rendering testimonials