The vulnerability arises from improper handling of attributes supplied to the testimonial_view shortcode in the Strong Testimonials plugin. An authenticated contributor or higher can inject arbitrary JavaScript that is stored and subsequently executed whenever any user accesses a page containing that shortcode. This enables an attacker to hijack sessions, steal credentials, deface content, or redirect users, thereby compromising confidentiality, integrity, and potentially availability.

The weakness impacts the Strong Testimonials plugin for WordPress released by wpchill. All versions up to and including 3.2.21 are affected and the flaw is tied specifically to the testimonial_view shortcode embedded in plugin templates.

The CVSS score of 6.4 indicates a moderate severity vulnerability that requires authenticated access, suggesting that privileged users can exploit it. EPSS data is unavailable and the issue is not listed in the CISA KEV catalog, so its exploitation probability is unknown. Attackers typically need to obtain or create a contributor-level account and then inject malicious attributes into the shortcode within a page or post. Because the flaw is stored and executed on page load, widespread exploitation could occur if sites are not patched promptly.