CVE-2026-3239

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3239", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-26T00:53:07.701Z", "datePublished": "2026-04-08T04:27:16.978Z", "dateUpdated": "2026-04-08T17:05:19.972Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:05:19.972Z"}, "affected": [{"vendor": "wpchill", "product": "Strong Testimonials", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.2.21", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's testimonial_view shortcode in all versions up to, and including, 3.2.21 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Strong Testimonials <= 3.2.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via testimonial_view Shortcode", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/88d769cd-bea8-42e4-80a8-a77c0699b50c?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3470120/strong-testimonials"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Ronnachai Sretawat Na Ayutaya"}], "timeline": [{"time": "2026-02-26T01:08:25.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-04-07T15:48:51.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-08T15:06:55.230866Z", "id": "CVE-2026-3239", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-08T15:07:02.450Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-3239", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-08T15:06:55.230866Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-08T15:06:59.189Z"}}], "cna": {"title": "Strong Testimonials <= 3.2.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via testimonial_view Shortcode", "credits": [{"lang": "en", "type": "finder", "value": "Ronnachai Sretawat Na Ayutaya"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "wpchill", "product": "Strong Testimonials", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.2.21"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-26T01:08:25.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-04-07T15:48:51.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/88d769cd-bea8-42e4-80a8-a77c0699b50c?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3470120/strong-testimonials"}], "descriptions": [{"lang": "en", "value": "The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's testimonial_view shortcode in all versions up to, and including, 3.2.21 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:05:19.972Z"}}}, "cveMetadata": {"cveId": "CVE-2026-3239", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:05:19.972Z", "dateReserved": "2026-02-26T00:53:07.701Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-04-08T04:27:16.978Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Strong Testimonials", "vendor": "wpchill", "versions": [{"lessThanOrEqual": "3.2.21", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's testimonial_view shortcode in all versions up to, and including, 3.2.21 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin Strong Testimonials para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s del shortcode 'testimonial_view' del plugin en todas las versiones hasta la 3.2.21, inclusive, debido a una sanitizaci\u00f3n de entrada y escape de salida insuficientes en los atributos proporcionados por el usuario. Esto hace posible que atacantes autenticados, con acceso de nivel de colaborador y superior, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2026-3239", "lastModified": "2026-07-25T10:10:00.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3239", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-08T15:06:55.230866Z", "version": "2.0.3"}}]}, "published": "2026-04-08T05:16:05.567", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3470120/strong-testimonials"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/88d769cd-bea8-42e4-80a8-a77c0699b50c?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.2.21]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Strong Testimonials", "source": "cna", "vendor": "wpchill"}, "product": "strong_testimonials", "vendor": "wpchill"}], "analysis": {"en": {"generated_at": "2026-04-08T05:20:15.246356+00:00", "value": {"mitigation_remediation": ["Update Strong Testimonials to version 3.2.22 or later", "Revoke or restrict contributor permissions if patching cannot be applied immediately", "Remove the testimonial_view shortcode from all pages until the issue is fixed", "Validate and sanitize all user\u2011supplied shortcode attributes on the site to prevent script injection"], "summary": {"action": "Patch", "impact": "Stored Cross-Site Scripting"}, "threat_synthesis": {"affected_systems": "The weakness impacts the Strong Testimonials plugin for WordPress released by wpchill. All versions up to and including 3.2.21 are affected and the flaw is tied specifically to the testimonial_view shortcode embedded in plugin templates.", "description_and_impact": "The vulnerability arises from improper handling of attributes supplied to the testimonial_view shortcode in the Strong Testimonials plugin. An authenticated contributor or higher can inject arbitrary JavaScript that is stored and subsequently executed whenever any user accesses a page containing that shortcode. This enables an attacker to hijack sessions, steal credentials, deface content, or redirect users, thereby compromising confidentiality, integrity, and potentially availability.", "risk_and_exploitability": "The CVSS score of 6.4 indicates a moderate severity vulnerability that requires authenticated access, suggesting that privileged users can exploit it. EPSS data is unavailable and the issue is not listed in the CISA KEV catalog, so its exploitation probability is unknown. Attackers typically need to obtain or create a contributor-level account and then inject malicious attributes into the shortcode within a page or post. Because the flaw is stored and executed on page load, widespread exploitation could occur if sites are not patched promptly."}}}}, "created": "2026-04-08T19:33:21.109541+00:00", "updated": "2026-04-08T19:43:57.453305+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress", "wpchill", "wpchill$PRODUCT$strong_testimonials"]}