CVE-2026-92622

The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lightbox_class' Shortcode Attribute in all versions up to, and including, 3.3.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the targeted testimonial view has at least one published testimonial with a featured image and the lightbox wrapper enabled, as the vulnerable code path is only reached when a thumbnail is rendered.

• CWE-79

• https://plugins.trac.wordpress.org/browser/strong-testimonials/tags/3.3.8/includes/class-strong-testimonials-render.php#L723
• https://plugins.trac.wordpress.org/browser/strong-testimonials/tags/3.3.8/includes/class-strong-testimonials-view-shortcode.php#L60
• https://plugins.trac.wordpress.org/browser/strong-testimonials/tags/3.3.8/includes/functions-image.php#L70
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3699887%40strong-testimonials&new=3699887%40strong-testimonials
• https://www.wordfence.com/threat-intel/vulnerabilities/id/52a92e3c-cb64-4fc5-9248-6f4fc2a6a3cc?source=cve

Published

Sep 18, 2026

Last Modified

Sep 18, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-92611In Eclipse Ankaios versions 0.6.0 to before 1.0.4, `LogRule:…4.8
• CVE-2026-92612In Eclipse iceoryx2 versions greater than v0.8.0, the Static…1
• CVE-2026-92615A flaw was found in flightctl. The configureRepoHTTPSClient(…6.6
• CVE-2026-92616FileRise before version 3.28.0 contains a privilege escalati…6.8
• CVE-2026-92619The Booking Calendar plugin for WordPress is vulnerable to P…7.2
• CVE-2026-9262Use of a non-secure protocol as the default FTP configuratio…7.5
• CVE-2026-92625Control iD iDSecure versions prior to 4.8.3.0 are affected b…7.5
• CVE-2026-92626Control iD iDSecure versions prior to 4.8.3.0 are affected b…7.5
• CVE-2026-92627A heap-use-after-free vulnerability exists in H5T__conv_f_f(…4.6
• CVE-2026-92628GitLab has remediated an issue in GitLab CE/EE affecting all…3.1
• CVE-2026-9263The Zephyr Bluetooth controller ISO Adaptation Layer (subsys…8.1
• CVE-2026-9264A cross-site scripting (XSS) vulnerability in SketchUp 2026'…9.3