The vulnerability is an improper neutralization of input during web page generation, allowing attackers to inject persistent malicious JavaScript into testimonial content. Stored cross‑site scripting means the injected code is served to any visitor who views the affected testimonial, potentially compromising user credentials, performing phishing, or defacing the site.

The flaw affects the WordPress Strong Testimonials plugin from the earliest releases up through version 3.3.12. All installations of the plugin below version 3.3.13 are susceptible and need to be upgraded or removed.

With a CVSS score of 7.1 the vulnerability is considered high severity, and the EPSS score is not available, indicating no publicly known exploitation but a potential for future attacks. Attackers would need to be able to insert malicious payloads into testimonials, likely via the plugin’s content editor, and the exploitation requires a victim to view the injected content in a browser. The plug‑in is listed as not in the CISA KEV catalog at present, but the risk remains significant in environments where testimonial content is widely viewed.