CVE-2026-107435: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in WP Chill Strong Testimonials

The vulnerability CVE-2026-107435 in WP Chill's Strong Testimonials plugin arises from improper neutralization of input during web page generation, leading to stored cross-site scripting (XSS). This flaw allows an attacker to inject malicious scripts that are stored and later executed in the context of users viewing the affected pages. The issue affects all versions from initial release up to 3.3.12 inclusive. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges but requires user interaction, and it impacts confidentiality, integrity, and availability of the affected system.

Successful exploitation of this stored XSS vulnerability can lead to execution of arbitrary scripts in the context of users visiting the affected site, potentially resulting in data theft, session hijacking, or other malicious actions affecting confidentiality, integrity, and availability. The high CVSS score reflects significant risk if exploited.

No explicit patch or remediation details are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling or restricting use of the Strong Testimonials plugin to mitigate risk.