Medium severity · published Oct 29, 2026
CVE-2026-114706
WordPress Strong Testimonials plugin <= 3.3.15 - Cross Site Scripting (XSS) vulnerability
New
6.5
CVSS
–
EPSS
No
On KEV
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Testimonials strong-testimonials allows Stored XSS.This issue affects Strong Testimonials: from n/a through 3.3.15.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ST
Strong Testimonials · WP Chill
through 3.3.15 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-114706
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-114706
vdb-entry
https://patchstack.com/database/wordpress/plugin/strong-testimonials/vulnerability/wordpress-strong-testimonials-plugin-3-3-15-cross-site-scripting-xss-vulnerability?_s_id=cve
More from Strong Testimonials
8.8
CVE-2026-107436
WordPress Strong Testimonials plugin <= 3.3.12 - PHP Object Injection vulnerability
8.8
CVE-2024-47362
WordPress Strong Testimonials plugin <= 3.1.16 - Broken Access Control vulnerability
7.1
CVE-2026-107435
WordPress Strong Testimonials plugin <= 3.3.12 - Cross Site Scripting (XSS) vulnerability
6.5
CVE-2026-97286
WordPress Strong Testimonials plugin <= 3.3.11 - Cross Site Scripting (XSS) vulnerability
6.5
CVE-2026-24957
WordPress Strong Testimonials plugin <= 3.2.20 - Broken Access Control vulnerability