---
id: CVE-2025-11268
title: >-
  The Strong Testimonials plugin for WordPress is vulnerable to arbitrary
  shortcode execution in all versions up to, and including, 3.2.16
summary: >-
  The Strong Testimonials plugin for WordPress is vulnerable to arbitrary
  shortcode execution in all versions up to, and including, 3.2.16. This is due
  to the software allowing users to submit a testimonial in which a value is not
  properly…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'
cwe:
  - CWE-79
published: '2025-11-06'
updated: '2026-10-07'
sourceUpdated: '2026-10-07T21:10:00.200'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-11268'
references:
  - url: 'https://plugins.trac.wordpress.org/changeset/3381902/strong-testimonials'
    label: security@wordfence.com
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/cbdfe58e-1e09-41b6-8ac9-6976c27aa58d?source=cve
    label: security@wordfence.com
tags:
  - nvd
epss: 0.00287
epssPercentile: 0.19414
ingestedAt: '2026-10-07T21:54:14.927Z'
---

## Overview

The Strong Testimonials plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.2.16. This is due to the software allowing users to submit a testimonial in which a value is not properly validated or sanitized prior to being passed to a do_shortcode call. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes if an administrator previews or publishes a crafted testimonial.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.