CVE-2025-11268CWE-79cross-site-scripting

CVE-2025-11268

Medium · published November 6, 2025

CVSS v3.1
4.3
EPSS
0%
Percentile
20.1
In the wild
Unconfirmed
What it is

The Strong Testimonials plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.2.16. This is due to the software allowing users to submit a testimonial in which a value is not properly validated or sanitized prior to being passed to a do_shortcode call. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes if an administrator previews or publishes a crafted testimonial.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00287 · 20.1th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-11-06T14:15Z
References (2)
https://plugins.trac.wordpress.org/changeset/3381902/strong-testimonials · [email protected]https://www.wordfence.com/threat-intel/vulnerabilities/id/cbdfe58e-1e09-41b6-8ac9-6976c27aa58d?source=cve · [email protected]
EPSS history
Timeline
  • 06 NOV 08:26Z
    Strong Testimonials <= 3.2.16 - Unauthenticated Arbitrary Shortcode Execution
    cvelistv5