The vulnerability is a stored XSS flaw in the Strong Testimonials WordPress plugin. An unauthenticated attacker can inject malicious scripts into the 'platform_user_photo' custom field. When a page containing the injected testimonial is loaded, the script executes under the visitor’s browser context. This weakness is a classic input validation and output escaping failure, identified as CWE‑79. The user‑level impact is that any visitor to the affected page may be subject to script‑based attacks such as cookie theft, session hijacking, or defacement. Direct exploitation does not grant the attacker credentials or system access, but it enables a persistent, client‑side attack vector.

The issue affects the Strong Testimonials plugin from wpchill, all releases up to and including version 3.3.11.

The CVSS score of 7.2 indicates a high severity vulnerability. The EPSS score is not available, but the lack of a KEV listing suggests it has not yet been widely exploited in the wild. Attackers can exploit this flaw without authentication by ensuring that an administrator has added the vulnerable custom fields to a public submission form. They then submit a testimonial containing crafted payloads, after which any browser that renders the testimonial will execute the injected script. The impact is largely confined to affected web pages and page visitors, but the persistence of the stored payload allows repeated exploitation.