CVE-2025-11268

Strong Testimonials <= 3.2.16 - Unauthenticated Arbitrary Shortcode Execution

2025-11-05 19:34
Kishan Vyas

Strategic Overview

Status
Patched in 3.2.17
Affected Plugin
Strong Testimonials
Affected Version
<= 3.2.16
CVSS
4.3Medium
Weakness type
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE
CVE-2025-11268
View all Strong Testimonials vulnerabilities

At a glance

CVE-2025-11268 is a medium-severity Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Strong Testimonials WordPress plugin, affecting versions <= 3.2.16. It carries a CVSS score of 4.3 (reachable over the network; low attack complexity). Exploitation requires no authentication. The issue is fixed in version 3.2.17; sites on affected versions should update now. Disclosed November 2025, reported by Kishan Vyas.

Vulnerability Overview

The Strong Testimonials plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.2.16. This is due to the software allowing users to submit a testimonial in which a value is not properly validated or sanitized prior to being passed to a do_shortcode call. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes if an administrator previews or publishes a crafted testimonial.

Technical Analysis

The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no privileges on the target site.

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Reaching this weakness in Strong Testimonials <= 3.2.16 takes no account at all. Cross-site scripting happens when input from a request is written into a page without being escaped for the context it lands in, so the browser parses attacker-supplied text as markup or script.

Injected script runs with the privileges of whoever views the affected page, which is how these flaws turn into administrator session theft, silent account creation or persistent backdoors in page content. For Strong Testimonials the fix is 3.2.17: builds <= 3.2.16 are affected, anything from 3.2.17 onward is not.

Remediation

Update to version 3.2.17, or a newer patched version

How does WordSec protect against this?

Requests carrying this pattern arrive without a session, so nothing upstream of the firewall gets a chance to reject them: WordSec's web application firewall inspects request payloads before WordPress loads them. None of that substitutes for the fix: Strong Testimonials 3.2.17 closes this, and updating the plugin is the step that ends it.

  • Firewall
  • Login Security
  • Alerts

External References

https://www.cve.org/CVERecord?id=CVE-2025-11268https://www.wordfence.com/threat-intel/vulnerabilities/id/cbdfe58e-1e09-41b6-8ac9-6976c27aa58dhttps://nvd.nist.gov/vuln/detail/CVE-2025-11268

Related records

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C