CVE-2025-11268 is a cross-site scripting vulnerability in the Strong Testimonials plugin for WordPress, affecting all versions up to 3.2.16. The issue arises from improper input validation and sanitization of testimonial content before it is passed to the do_shortcode function, allowing unauthenticated attackers to inject and execute arbitrary shortcodes. Exploitation requires an administrator to interact with the crafted testimonial by previewing or publishing it. This vulnerability has a CVSS 3.1 base score of 4.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, but user interaction needed.

An unauthenticated attacker can submit a malicious testimonial containing arbitrary shortcodes that execute when an administrator previews or publishes the testimonial. This can lead to limited impact such as injection of unintended shortcode functionality, but does not directly compromise confidentiality or availability. The vulnerability does not allow direct code execution or data disclosure without administrator interaction.

Patch status is not yet confirmed — no official fix or patch links are provided in the available data. Users should monitor the vendor's advisory for updates. Until a patch is available, administrators should avoid previewing or publishing testimonials from untrusted sources. Applying strict input validation or disabling shortcode execution in testimonials may reduce risk.