Strong Testimonials <= 3.3.11 - Unauthenticated Stored Cross-Site Scripting via 'platform_user_photo' Custom Field

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-96650 · Microsoft / collected KEV context

cve-program · CVE-2026-96650

• https://www.wordfence.com/threat-intel/vulnerabilities/id/73c8267c-8c03-4ee6-9d3e-e383188b82ad?source=cve
• https://plugins.trac.wordpress.org/browser/strong-testimonials/tags/3.3.10/includes/functions-image.php#L242
• https://plugins.trac.wordpress.org/browser/strong-testimonials/tags/3.3.10/includes/functions-image.php#L275
• https://plugins.trac.wordpress.org/browser/strong-testimonials/tags/3.3.10/includes/class-strong-testimonials-form.php#L260
• https://plugins.trac.wordpress.org/browser/strong-testimonials/tags/3.3.10/includes/class-strong-testimonials-form.php#L32
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3711376%40strong-testimonials&new=3711376%40strong-testimonials

No related operational record is retained in the current change model.