CVE-2026-96650 is a stored cross-site scripting vulnerability in the Strong Testimonials plugin for WordPress (versions up to 3.3.11). It occurs due to improper neutralization of input in the 'platform_user_photo' custom field, which lacks sufficient sanitization and escaping. An unauthenticated attacker can inject arbitrary scripts that execute when users access the affected testimonial pages. Successful exploitation depends on the presence of administrator-added custom fields named 'platform' and 'platform_user_photo', as these keys are not reserved internally by the plugin.

An attacker can inject malicious scripts into testimonial pages, which execute in the context of users visiting those pages. This can lead to theft of user credentials, session hijacking, or other malicious actions limited to the scope of the affected website. The vulnerability does not require authentication but depends on specific custom fields being configured by an administrator.

No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid adding or using custom text fields named 'platform' and 'platform_user_photo' in public testimonial forms. Monitoring vendor channels for updates is recommended.