CVE-2026-3239

BRIEFING NOTE: CVE-2026-3239 The Strong Testimonials plugin for WordPress versions up to 3.2.21 contains a Stored Cross-Site Scripting (XSS) vulnerability in the testimonial_view shortcode. Insufficient input sanitization and output escaping of user-supplied attributes allows authenticated attackers with contributor-level permissions or above to inject arbitrary malicious scripts into pages. When other users access these compromised pages, the injected scripts execute in their browsers, potentially compromising user sessions or sensitive data. This vulnerability carries a CVSS v3.1 score of 6.4 (Medium severity) with a network-based attack vector requiring low complexity and low privileges. While the attack requires authentication and user interaction is not needed, the scope is changed and impacts both confidentiality and integrity. The FAUCET Risk Score of 44.0 out of 100 suggests moderate concern from a risk perspective. Currently, there is no evidence of active exploitation in the wild. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog and shows no presence on security community hot lists. The extremely low EPSS score of 0.0003 indicates minimal probability of exploitation, suggesting this remains a lower-priority remediation compared to more actively targeted vulnerabilities. Organizations should prioritize patching to versions beyond 3.2.21 but may defer this below critical vulnerabilities currently under active exploitation.