CVE-2026-92622: Strong Testimonials WordPress Plugin XSS

CVE-2026-92622 Overview

CVE-2026-92622 is a Stored Cross-Site Scripting (XSS) vulnerability in the Strong Testimonials plugin for WordPress. The flaw affects all versions up to and including 3.3.8. It stems from insufficient input sanitization and output escaping on the lightbox_class shortcode attribute. Authenticated attackers with contributor-level access or above can inject arbitrary web scripts into pages. The injected scripts execute in the browsers of users who visit an affected page. Exploitation requires the targeted testimonial view to contain at least one published testimonial with a featured image and the lightbox wrapper enabled, since the vulnerable code path only executes when a thumbnail is rendered. The issue is tracked under [CWE-79].

Critical Impact
Contributor-level users can persist JavaScript that executes for site visitors and administrators, enabling session theft, account takeover, and site defacement.

Affected Products

Strong Testimonials plugin for WordPress, all versions through 3.3.8
WordPress sites permitting contributor-level or higher user registrations
Testimonial views configured with the lightbox wrapper enabled

Discovery Timeline

2026-09-18 - CVE-2026-92622 published to NVD
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-92622

Vulnerability Analysis

Strong Testimonials exposes a [strong] shortcode that accepts a lightbox_class attribute. That attribute is later concatenated into the HTML markup surrounding testimonial thumbnails without sufficient sanitization or output escaping. When the plugin renders a testimonial view that includes at least one entry with a featured image and the lightbox enabled, the vulnerable rendering path executes and emits attacker-controlled content into the page.

Because contributor accounts can author posts containing shortcodes, a low-privileged user can plant a payload that persists in stored content. The stored payload executes for any visitor, including administrators, when the affected page loads. Successful exploitation gives the attacker script execution in the victim's browser under the site's origin, enabling session hijacking, forced actions through the WordPress REST API, or delivery of secondary payloads.

Root Cause

The root cause is missing sanitization of the lightbox_class shortcode attribute and missing output escaping when the value is rendered into HTML. The plugin trusts the attribute as a CSS class name and injects it directly into the DOM. See the vulnerable rendering logic in class-strong-testimonials-render.php, the shortcode parser in class-strong-testimonials-view-shortcode.php, and the image helper in functions-image.php.

Attack Vector

The attack is network-reachable and requires authentication at contributor level or above. The attacker submits post or page content containing a [strong] shortcode with a malicious lightbox_class value. When any visitor renders a testimonial view meeting the trigger conditions, the payload fires. Refer to the Wordfence Vulnerability Analysis for additional technical context.

No verified public exploit code is available. A prose description of the flaw appears above.

Detection Methods for CVE-2026-92622

Indicators of Compromise

Post or page content containing [strong] shortcodes with unusual lightbox_class attribute values, especially values containing quotes, angle brackets, on*= handlers, or javascript: tokens.
New or modified testimonials authored by contributor-level accounts shortly before suspicious activity.
Outbound requests from visitor browsers to unfamiliar domains after loading pages that render testimonial views.

Detection Strategies

Scan the wp_posts table for post_content values matching lightbox_class="[^\"]*[<>"'=] to surface attribute values containing HTML metacharacters.
Review WordPress audit logs for contributor accounts creating or editing posts that embed [strong] shortcodes.
Inspect rendered HTML for testimonial view pages and flag class attributes carrying script-like tokens.

Monitoring Recommendations

Alert on new user registrations at contributor role or higher, and on privilege changes affecting existing accounts.
Monitor Content Security Policy (CSP) violation reports for inline script executions on pages that render testimonials.
Track file integrity for the Strong Testimonials plugin directory to detect unauthorized modifications.

How to Mitigate CVE-2026-92622

Immediate Actions Required

Update the Strong Testimonials plugin to the patched release referenced in the vendor changeset.
Audit contributor, author, and editor accounts and revoke access for any that are unused or unrecognized.
Review existing testimonials and posts for embedded [strong] shortcodes with suspicious lightbox_class values and remove them.

Patch Information

The vendor addressed the issue in a release following 3.3.8. The fix applies proper sanitization and output escaping to the lightbox_class attribute before it is rendered. Details are available in the Strong Testimonials Changeset and the Wordfence Vulnerability Analysis.

Workarounds

Disable the lightbox wrapper on all testimonial views until the plugin is updated, since the vulnerable code path only executes when a thumbnail is rendered with the lightbox enabled.
Restrict shortcode usage for contributor-level accounts by removing the ability to publish content containing the [strong] shortcode.
Deploy a Web Application Firewall (WAF) rule that blocks lightbox_class attribute values containing <, >, ", or on*= handler patterns.

bash

# Example WAF pattern to block malicious lightbox_class values
# (adapt to your WAF's rule syntax)
SecRule ARGS|REQUEST_BODY "@rx lightbox_class\s*=\s*[\"'][^\"']*[<>\"'=]" \
    "id:1092622,phase:2,deny,log,msg:'CVE-2026-92622 Strong Testimonials XSS attempt'"