Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

Strong Testimonials plugin <=3.3.12 may execute malicious code

CVE-2026-107436 · published today
Summary

The Strong Testimonials plugin for WordPress (versions up to 3.3.12) can be fooled into processing crafted data, allowing an attacker to run their own code on your site. This could let a bad actor take control of the website or steal information. Upgrade to the latest version of the plugin or disable it until it is updated.

What to do
  • Update wp chill strong testimonials to version 3.3.13.
Affected software
VendorProductAffected versions
wp chill strong testimonials <= 3.3.12
Fix: upgrade to 3.3.13
Original advisory text
WordPress Strong Testimonials plugin <= 3.3.12 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in WP Chill Strong Testimonials strong-testimonials allows Object Injection.This issue affects Strong Testimonials: from n/a through 3.3.12.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
8.8 High
Type
CWE-502Deserialization of Untrusted Data
Timeline
Published18 Oct 2026
Updated18 Oct 2026
First seen18 Oct 2026
Sources
CVE-2026-107436 · NVD
CVE-2026-107436 · MITRE
Track software like this
Free during beta