The vulnerability resides in the Strong Testimonials plugin for WordPress, where insufficient input sanitization and output escaping in the testimonial custom fields allows an authenticated user with Author-level access or higher to inject arbitrary scripts into pages. These injected scripts execute automatically whenever a page containing the testimonial is rendered in a visitor’s browser, exposing that visitor to malicious code. The weakness is a classic stored Cross‑Site Scripting flaw, commonly labeled CWE‑79.

All installations of wpchill Strong Testimonials version 3.2.11 or earlier are affected. The flaw exists in the custom fields functionality of the plugin; the issue is not limited to a specific host environment but applies to any WordPress site running the vulnerable plugin version.

The CVSS base score is 6.4, indicating a moderate severity. The EPSS score is reported as less than 1%, signifying a very low likelihood of exploitation under current observations. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread active exploitation is known. The attack can be performed remotely via the WordPress administrative interface, requiring only author‑level authentication; once an author injects a payload, any site visitor will be subject to the XSS effect.