Medium severity · published Feb 3, 2020
CVE-2020-8549
Stored XSS in the Strong Testimonials plugin before 2.40.1 for WordPress can result in an attacker performing malicious actions such as stealing session tokens
6.1
CVSS
1.9%
EPSS
No
On KEV
Description
Stored XSS in the Strong Testimonials plugin before 2.40.1 for WordPress can result in an attacker performing malicious actions such as stealing session tokens.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.9% · higher than 79% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ST
Strong Testimonials · Wpchill
before 2.40.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-8549
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-8549
Exploit
http://packetstormsecurity.com/files/156369/WordPress-Strong-Testimonials-2.40.1-Cross-Site-Scripting.html
Release Notes
https://github.com/MachoThemes/strong-testimonials/blob/master/changelog.txt
Third Party Advisory
https://wpvulndb.com/vulnerabilities/10056
Exploit
https://www.getastra.com/blog/911/plugin-exploit/stored-xss-vulnerability-found-in-strong-testimonials-plugin/
Exploit
https://www.jinsonvarghese.com/stored-xss-vulnerability-in-strong-testimonials-plugin/
More from Strong Testimonials
8.8
CVE-2024-47362
WordPress Strong Testimonials plugin <= 3.1.16 - Broken Access Control vulnerability
8.8
CVE-2023-52123
WordPress Strong Testimonials Plugin <= 3.1.10 is vulnerable to Cross Site Request Forgery (CSRF)
7.2
CVE-2026-96650
Strong Testimonials <= 3.3.11 - Unauthenticated Stored Cross-Site Scripting via 'platform_user_photo' Custom Field
6.4
CVE-2026-92622
Strong Testimonials <= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lightbox_class' Shortcode Attribute
6.4
CVE-2026-3239
Strong Testimonials <= 3.2.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via testimonial_view Shortcode