CVE-2026-96650: Strong Testimonials WordPress XSS Vulnerability

CVE-2026-96650 Overview

CVE-2026-96650 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Strong Testimonials plugin for WordPress. The flaw affects all versions up to and including 3.3.11. It stems from insufficient input sanitization and output escaping on the platform_user_photo custom field. Unauthenticated attackers can inject arbitrary web scripts that execute whenever a user accesses an affected page. Exploitation requires an administrator to have added custom text fields named platform and platform_user_photo to a public testimonial submission form, since the plugin does not reserve those internal metadata keys.

Critical Impact
Unauthenticated attackers can inject persistent JavaScript into testimonial pages, enabling session theft, phishing, and administrative account takeover when a privileged user views the content.

Affected Products

Strong Testimonials plugin for WordPress — all versions through 3.3.11
Sites that expose a public testimonial submission form
Sites where an administrator added custom text fields named platform and platform_user_photo

Discovery Timeline

2026-10-03 - CVE-2026-96650 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-96650

Vulnerability Analysis

The vulnerability lives in the public submission path of the Strong Testimonials plugin. The plugin accepts custom fields defined by administrators but does not reserve its internal metadata keys. When an administrator creates text fields literally named platform and platform_user_photo, submitted values flow through code paths intended for internal photo metadata. The affected handlers in class-strong-testimonials-form.php and functions-image.php neither sanitize the input on write nor escape it on output. Attackers can submit a testimonial that embeds a script payload in the platform_user_photo value. The payload is stored in post metadata and rendered unescaped when visitors or administrators view the testimonial, triggering script execution in their browser context.

Root Cause

The root cause is a namespace collision between user-defined custom field keys and reserved plugin metadata keys, compounded by missing sanitization and output escaping. The plugin trusts the platform_user_photo value as internal image data rather than treating it as untrusted user input.

Attack Vector

An unauthenticated remote attacker submits the public testimonial form with a crafted platform_user_photo value containing HTML or JavaScript. The payload is stored in the database. When any user loads a page that renders the testimonial, the browser executes the injected script in the site's origin. The scope-changing nature of the flaw allows the payload to affect administrators and other authenticated users. See the Wordfence Threat Intelligence entry and the plugin changeset for the patched behavior.

Detection Methods for CVE-2026-96650

Indicators of Compromise

Testimonial post metadata containing <script>, onerror=, onload=, or javascript: strings in the platform_user_photo key
Unexpected outbound requests from browsers rendering testimonial pages to attacker-controlled domains
Newly created administrator accounts or modified user roles following testimonial submissions
Testimonial form submissions originating from anonymous IPs with unusually long field values

Detection Strategies

Query the wp_postmeta table for meta_key values of platform_user_photo and inspect meta_value for HTML tags or event handlers
Review web server access logs for POST requests to the testimonial submission endpoint containing script fragments
Enable a Content Security Policy in report-only mode to surface inline script execution on testimonial pages

Monitoring Recommendations

Monitor WordPress audit logs for creation of custom testimonial fields named platform or platform_user_photo
Alert on administrator session activity immediately following views of testimonial content
Track plugin version inventory and flag any Strong Testimonials install at 3.3.11 or below

How to Mitigate CVE-2026-96650

Immediate Actions Required

Update the Strong Testimonials plugin to the version that follows changeset 3711376 on the WordPress plugin repository
Remove or rename any administrator-created custom fields using the keys platform or platform_user_photo
Audit existing testimonials for stored script payloads and purge affected entries
Rotate credentials for administrator accounts that viewed the testimonial pages during the exposure window

Patch Information

The vendor addressed the issue in the commit tracked by the Strong Testimonials changeset 3711376. The fix adds sanitization and output escaping to the affected code paths in class-strong-testimonials-form.php and functions-image.php. Upgrade from the WordPress admin plugins screen or via WP-CLI.

Workarounds

Disable public testimonial submission until the plugin is updated
Remove custom fields that collide with the plugin's internal metadata keys, specifically platform and platform_user_photo
Place the submission endpoint behind a web application firewall rule that blocks requests containing <script or event handler attributes in form fields
Require authentication or CAPTCHA on the testimonial form to limit anonymous abuse

bash

# Configuration example: upgrade and audit via WP-CLI
wp plugin update strong-testimonials
wp db query "SELECT post_id, meta_value FROM wp_postmeta WHERE meta_key = 'platform_user_photo';"