The Strong Testimonials WordPress plugin up to version 3.2.16 contains a vulnerability that allows unauthenticated attackers to execute arbitrary shortcodes by submitting crafted testimonials. This occurs because user input is not properly validated or sanitized before being processed by the do_shortcode function. Exploitation requires an administrator to preview or publish the malicious testimonial, potentially leading to limited integrity impact.