The plugin is vulnerable to arbitrary shortcode execution in all versions up to and including 3.2.16 due to lack of validation when a testimonial value is passed to do_shortcode. This flaw allows an unauthenticated attacker to craft a testimonial that triggers the execution of any shortcode during the preview or publish process. The vulnerability is tied to CWE‑79 and can lead to unexpected behavior or code execution if the attacker supplies a malicious shortcode.

All users of the WordPress “Strong Testimonials” plugin version 3.2.16 or older are affected. This includes any site that has installed the plugin and has not yet upgraded to a later version. Site administrators who allow testimonial submissions could be impacted when an attacker submits a crafted testimonial.

The CVSS score of 4.3 indicates moderate severity, and the EPSS score of <1% suggests a low probability of current exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector is likely HTTP through the testimonial submission form; an attacker only needs to submit a malicious testimonial and does not require authenticated access. If the shortcode processor evaluates code, this could enable arbitrary execution.