Search
Find a vulnerability
Search criteria
10 vulnerabilities found for Rich Showcase for Google Reviews by widgetpack
CVE-2026-110020 (GCVE-0-2026-110020)
Vulnerability from nvd – Published: 2026-10-28 06:45 – Updated: 2026-10-29 01:41
VLAI
EPSS
VEX
Title
Rich Showcase for Google Reviews <= 7.1.6 - Missing Authorization to Authenticated (Contributor+) Site Secret Disclosure via 'grw_auth_code' Site Secret Disclosure via grw-builder Admin Page
Summary
The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.1.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to retrieve the plugin's 127-character site-wide grw_auth_code authentication secret and use it to impersonate the WordPress site to the RichPlugins backend service at app.richplugins.com.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 01:31 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| widgetpack | Rich Showcase for Google Reviews |
Affected:
0 , ≤ 7.1.6
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110020",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T01:31:02.976167Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T01:41:53.443Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Rich Showcase for Google Reviews",
"vendor": "widgetpack",
"versions": [
{
"lessThanOrEqual": "7.1.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.1.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to retrieve the plugin\u0027s 127-character site-wide grw_auth_code authentication secret and use it to impersonate the WordPress site to the RichPlugins backend service at app.richplugins.com."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T06:45:11.326Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3bcf9640-ef7e-4cff-ada2-5ddc4261befa?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/widget-google-reviews/tags/7.1.6/includes/class-builder-page.php#L193"
},
{
"url": "https://plugins.trac.wordpress.org/browser/widget-google-reviews/tags/7.1.6/includes/class-builder-page.php#L71"
},
{
"url": "https://plugins.trac.wordpress.org/browser/widget-google-reviews/tags/7.1.6/includes/admin/class-admin-menu.php#L78"
},
{
"url": "https://downloads.wordpress.org/plugin/widget-google-reviews.7.1.7.zip"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-13T15:14:07.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-27T17:50:03.000Z",
"value": "Disclosed"
}
],
"title": "Rich Showcase for Google Reviews \u003c= 7.1.6 - Missing Authorization to Authenticated (Contributor+) Site Secret Disclosure via \u0027grw_auth_code\u0027 Site Secret Disclosure via grw-builder Admin Page"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-110020",
"datePublished": "2026-10-28T06:45:11.326Z",
"dateReserved": "2026-10-13T14:58:36.169Z",
"dateUpdated": "2026-10-29T01:41:53.443Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100148 (GCVE-0-2026-100148)
Vulnerability from nvd – Published: 2026-10-03 05:29 – Updated: 2026-10-03 15:42
VLAI
EPSS
VEX
Title
Rich Showcase for Google Reviews <= 7.1.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Google Review Text (imported via Places API)
Summary
The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'reviews[].text' parameter in all versions up to, and including, 7.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is delivered entirely through a Google review posted for the connected business and requires no WordPress account; the plugin's default daily cron auto-imports the malicious review text, and execution triggers for every visitor on DOMContentLoaded without any further user interaction.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-03 15:26 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| widgetpack | Rich Showcase for Google Reviews |
Affected:
0 , ≤ 7.1.3
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-100148",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-03T15:26:26.250459Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-03T15:42:43.676Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Rich Showcase for Google Reviews",
"vendor": "widgetpack",
"versions": [
{
"lessThanOrEqual": "7.1.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakub Herman"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027reviews[].text\u0027 parameter in all versions up to, and including, 7.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is delivered entirely through a Google review posted for the connected business and requires no WordPress account; the plugin\u0027s default daily cron auto-imports the malicious review text, and execution triggers for every visitor on DOMContentLoaded without any further user interaction."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-03T05:29:18.617Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f2f3a5be-0b69-43aa-a56f-d602d5def7dc?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/widget-google-reviews/tags/7.1.2/assets/7.1.2/js/public-main.js#L14"
},
{
"url": "https://plugins.trac.wordpress.org/browser/widget-google-reviews/tags/7.1.2/includes/class-view.php#L535"
},
{
"url": "https://plugins.trac.wordpress.org/browser/widget-google-reviews/tags/7.1.2/includes/class-view.php#L453"
},
{
"url": "https://plugins.trac.wordpress.org/browser/widget-google-reviews/tags/7.1.2/includes/core/class-google-dao.php#L410"
},
{
"url": "https://plugins.trac.wordpress.org/browser/widget-google-reviews/tags/7.1.2/includes/core/class-google-dao.php#L445"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3719682%40widget-google-reviews\u0026new=3719682%40widget-google-reviews"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-25T11:56:29.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-02T17:16:42.000Z",
"value": "Disclosed"
}
],
"title": "Rich Showcase for Google Reviews \u003c= 7.1.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Google Review Text (imported via Places API)"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-100148",
"datePublished": "2026-10-03T05:29:18.617Z",
"dateReserved": "2026-09-25T11:41:25.358Z",
"dateUpdated": "2026-10-03T15:42:43.676Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15739 (GCVE-0-2026-15739)
Vulnerability from nvd – Published: 2026-07-24 07:53 – Updated: 2026-07-24 14:24
VLAI
EPSS
VEX
Title
Rich Showcase for Google Reviews <= 6.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pagination' Shortcode Attribute
Summary
The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'pagination' Shortcode Attribute in all versions up to, and including, 6.9.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-24 14:23 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
10 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| widgetpack | Rich Showcase for Google Reviews |
Affected:
0 , ≤ 6.9.9
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15739",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-24T14:23:50.359067Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T14:24:07.142Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Rich Showcase for Google Reviews",
"vendor": "widgetpack",
"versions": [
{
"lessThanOrEqual": "6.9.9",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via \u0027pagination\u0027 Shortcode Attribute in all versions up to, and including, 6.9.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T07:53:36.691Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c3851607-73e7-44ae-8d5b-e8b7460851ea?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/widget-google-reviews/tags/6.9.7/includes/class-view.php#L336"
},
{
"url": "https://plugins.trac.wordpress.org/browser/widget-google-reviews/tags/6.9.8/includes/class-view.php#L336"
},
{
"url": "https://plugins.trac.wordpress.org/browser/widget-google-reviews/tags/6.9.8/includes/class-view.php#L172"
},
{
"url": "https://plugins.trac.wordpress.org/browser/widget-google-reviews/tags/6.9.8/includes/class-feed-old.php#L45"
},
{
"url": "https://plugins.trac.wordpress.org/browser/widget-google-reviews/tags/6.9.8/includes/class-feed-shortcode.php#L33"
},
{
"url": "https://plugins.trac.wordpress.org/browser/widget-google-reviews/tags/6.9.7/includes/class-view.php#L172"
},
{
"url": "https://plugins.trac.wordpress.org/browser/widget-google-reviews/tags/6.9.7/includes/class-feed-old.php#L45"
},
{
"url": "https://plugins.trac.wordpress.org/browser/widget-google-reviews/tags/6.9.7/includes/class-feed-shortcode.php#L33"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3610853%40widget-google-reviews%2Ftrunk\u0026old=3606801%40widget-google-reviews%2Ftrunk"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-14T14:38:09.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-23T19:00:45.000Z",
"value": "Disclosed"
}
],
"title": "Rich Showcase for Google Reviews \u003c= 6.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via \u0027pagination\u0027 Shortcode Attribute"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-15739",
"datePublished": "2026-07-24T07:53:36.691Z",
"dateReserved": "2026-07-14T14:22:59.359Z",
"dateUpdated": "2026-07-24T14:24:07.142Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-12499 (GCVE-0-2025-12499)
Vulnerability from nvd – Published: 2025-12-06 07:29 – Updated: 2026-04-08 17:29
VLAI
EPSS
VEX
Title
Rich Shortcodes for Google Reviews <= 6.8 - Unauthenticated Stored Cross-Site Scripting via Google Review
Summary
The Rich Shortcodes for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the contents of a Google Review in all versions up to, and including, 6.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability was partially patched in version 6.6.2.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-12-08 21:26 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| widgetpack | Rich Showcase for Google Reviews |
Affected:
0 , ≤ 6.8
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-12499",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-08T21:26:30.864221Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-12-08T21:26:41.020Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Rich Showcase for Google Reviews",
"vendor": "widgetpack",
"versions": [
{
"lessThanOrEqual": "6.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Kishan Vyas"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Rich Shortcodes for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the contents of a Google Review in all versions up to, and including, 6.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability was partially patched in version 6.6.2."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T17:29:15.291Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e2960224-4446-4fc6-8d18-6f9911b4cbad?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3411521/widget-google-reviews"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3389203/widget-google-reviews"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-11-03T16:47:24.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2025-12-05T18:52:16.000Z",
"value": "Disclosed"
}
],
"title": "Rich Shortcodes for Google Reviews \u003c= 6.8 - Unauthenticated Stored Cross-Site Scripting via Google Review"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2025-12499",
"datePublished": "2025-12-06T07:29:11.782Z",
"dateReserved": "2025-10-29T23:43:41.517Z",
"dateUpdated": "2026-04-08T17:29:15.291Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-6884 (GCVE-0-2023-6884)
Vulnerability from nvd – Published: 2024-02-05 21:21 – Updated: 2026-04-08 17:13
VLAI
EPSS
VEX
Title
Plugin for Google Reviews <= 3.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode
Summary
This plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in all versions up to, and including, 3.1 due to insufficient input sanitization and output escaping on the 'place_id' attribute. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-02-11 18:22 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| widgetpack | Rich Showcase for Google Reviews |
Affected:
0 , ≤ 3.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-6884",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-11T18:22:12.831492Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:17:21.520Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T08:42:07.970Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a8971d54-b54e-4e62-9db2-fa87d2564599?source=cve"
},
{
"tags": [
"x_transferred"
],
"url": "https://plugins.svn.wordpress.org/widget-google-reviews/tags/3.1/includes/class-feed-shortcode.php"
},
{
"tags": [
"x_transferred"
],
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3018964%40widget-google-reviews\u0026new=3018964%40widget-google-reviews\u0026sfp_email=\u0026sfph_mail="
},
{
"tags": [
"x_transferred"
],
"url": "https://advisory.abay.sh/cve-2023-6884"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Rich Showcase for Google Reviews",
"vendor": "widgetpack",
"versions": [
{
"lessThanOrEqual": "3.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Akbar Kustirama"
}
],
"descriptions": [
{
"lang": "en",
"value": "This plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin\u0027s shortcode in all versions up to, and including, 3.1 due to insufficient input sanitization and output escaping on the \u0027place_id\u0027 attribute. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T17:13:55.206Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a8971d54-b54e-4e62-9db2-fa87d2564599?source=cve"
},
{
"url": "https://plugins.svn.wordpress.org/widget-google-reviews/tags/3.1/includes/class-feed-shortcode.php"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3018964%40widget-google-reviews\u0026new=3018964%40widget-google-reviews\u0026sfp_email=\u0026sfph_mail="
},
{
"url": "https://advisory.abay.sh/cve-2023-6884"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-01-12T00:00:00.000Z",
"value": "Disclosed"
}
],
"title": "Plugin for Google Reviews \u003c= 3.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2023-6884",
"datePublished": "2024-02-05T21:21:56.066Z",
"dateReserved": "2023-12-16T01:01:04.366Z",
"dateUpdated": "2026-04-08T17:13:55.206Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110020 (GCVE-0-2026-110020)
Vulnerability from cvelistv5 – Published: 2026-10-28 06:45 – Updated: 2026-10-29 01:41
VLAI
EPSS
VEX
Title
Rich Showcase for Google Reviews <= 7.1.6 - Missing Authorization to Authenticated (Contributor+) Site Secret Disclosure via 'grw_auth_code' Site Secret Disclosure via grw-builder Admin Page
Summary
The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.1.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to retrieve the plugin's 127-character site-wide grw_auth_code authentication secret and use it to impersonate the WordPress site to the RichPlugins backend service at app.richplugins.com.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 01:31 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| widgetpack | Rich Showcase for Google Reviews |
Affected:
0 , ≤ 7.1.6
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110020",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T01:31:02.976167Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T01:41:53.443Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Rich Showcase for Google Reviews",
"vendor": "widgetpack",
"versions": [
{
"lessThanOrEqual": "7.1.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.1.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to retrieve the plugin\u0027s 127-character site-wide grw_auth_code authentication secret and use it to impersonate the WordPress site to the RichPlugins backend service at app.richplugins.com."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T06:45:11.326Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3bcf9640-ef7e-4cff-ada2-5ddc4261befa?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/widget-google-reviews/tags/7.1.6/includes/class-builder-page.php#L193"
},
{
"url": "https://plugins.trac.wordpress.org/browser/widget-google-reviews/tags/7.1.6/includes/class-builder-page.php#L71"
},
{
"url": "https://plugins.trac.wordpress.org/browser/widget-google-reviews/tags/7.1.6/includes/admin/class-admin-menu.php#L78"
},
{
"url": "https://downloads.wordpress.org/plugin/widget-google-reviews.7.1.7.zip"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-13T15:14:07.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-27T17:50:03.000Z",
"value": "Disclosed"
}
],
"title": "Rich Showcase for Google Reviews \u003c= 7.1.6 - Missing Authorization to Authenticated (Contributor+) Site Secret Disclosure via \u0027grw_auth_code\u0027 Site Secret Disclosure via grw-builder Admin Page"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-110020",
"datePublished": "2026-10-28T06:45:11.326Z",
"dateReserved": "2026-10-13T14:58:36.169Z",
"dateUpdated": "2026-10-29T01:41:53.443Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100148 (GCVE-0-2026-100148)
Vulnerability from cvelistv5 – Published: 2026-10-03 05:29 – Updated: 2026-10-03 15:42
VLAI
EPSS
VEX
Title
Rich Showcase for Google Reviews <= 7.1.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Google Review Text (imported via Places API)
Summary
The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'reviews[].text' parameter in all versions up to, and including, 7.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is delivered entirely through a Google review posted for the connected business and requires no WordPress account; the plugin's default daily cron auto-imports the malicious review text, and execution triggers for every visitor on DOMContentLoaded without any further user interaction.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-03 15:26 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| widgetpack | Rich Showcase for Google Reviews |
Affected:
0 , ≤ 7.1.3
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-100148",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-03T15:26:26.250459Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-03T15:42:43.676Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Rich Showcase for Google Reviews",
"vendor": "widgetpack",
"versions": [
{
"lessThanOrEqual": "7.1.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakub Herman"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027reviews[].text\u0027 parameter in all versions up to, and including, 7.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is delivered entirely through a Google review posted for the connected business and requires no WordPress account; the plugin\u0027s default daily cron auto-imports the malicious review text, and execution triggers for every visitor on DOMContentLoaded without any further user interaction."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-03T05:29:18.617Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f2f3a5be-0b69-43aa-a56f-d602d5def7dc?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/widget-google-reviews/tags/7.1.2/assets/7.1.2/js/public-main.js#L14"
},
{
"url": "https://plugins.trac.wordpress.org/browser/widget-google-reviews/tags/7.1.2/includes/class-view.php#L535"
},
{
"url": "https://plugins.trac.wordpress.org/browser/widget-google-reviews/tags/7.1.2/includes/class-view.php#L453"
},
{
"url": "https://plugins.trac.wordpress.org/browser/widget-google-reviews/tags/7.1.2/includes/core/class-google-dao.php#L410"
},
{
"url": "https://plugins.trac.wordpress.org/browser/widget-google-reviews/tags/7.1.2/includes/core/class-google-dao.php#L445"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3719682%40widget-google-reviews\u0026new=3719682%40widget-google-reviews"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-25T11:56:29.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-02T17:16:42.000Z",
"value": "Disclosed"
}
],
"title": "Rich Showcase for Google Reviews \u003c= 7.1.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Google Review Text (imported via Places API)"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-100148",
"datePublished": "2026-10-03T05:29:18.617Z",
"dateReserved": "2026-09-25T11:41:25.358Z",
"dateUpdated": "2026-10-03T15:42:43.676Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15739 (GCVE-0-2026-15739)
Vulnerability from cvelistv5 – Published: 2026-07-24 07:53 – Updated: 2026-07-24 14:24
VLAI
EPSS
VEX
Title
Rich Showcase for Google Reviews <= 6.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pagination' Shortcode Attribute
Summary
The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'pagination' Shortcode Attribute in all versions up to, and including, 6.9.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-24 14:23 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
10 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| widgetpack | Rich Showcase for Google Reviews |
Affected:
0 , ≤ 6.9.9
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15739",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-24T14:23:50.359067Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T14:24:07.142Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Rich Showcase for Google Reviews",
"vendor": "widgetpack",
"versions": [
{
"lessThanOrEqual": "6.9.9",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via \u0027pagination\u0027 Shortcode Attribute in all versions up to, and including, 6.9.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T07:53:36.691Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c3851607-73e7-44ae-8d5b-e8b7460851ea?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/widget-google-reviews/tags/6.9.7/includes/class-view.php#L336"
},
{
"url": "https://plugins.trac.wordpress.org/browser/widget-google-reviews/tags/6.9.8/includes/class-view.php#L336"
},
{
"url": "https://plugins.trac.wordpress.org/browser/widget-google-reviews/tags/6.9.8/includes/class-view.php#L172"
},
{
"url": "https://plugins.trac.wordpress.org/browser/widget-google-reviews/tags/6.9.8/includes/class-feed-old.php#L45"
},
{
"url": "https://plugins.trac.wordpress.org/browser/widget-google-reviews/tags/6.9.8/includes/class-feed-shortcode.php#L33"
},
{
"url": "https://plugins.trac.wordpress.org/browser/widget-google-reviews/tags/6.9.7/includes/class-view.php#L172"
},
{
"url": "https://plugins.trac.wordpress.org/browser/widget-google-reviews/tags/6.9.7/includes/class-feed-old.php#L45"
},
{
"url": "https://plugins.trac.wordpress.org/browser/widget-google-reviews/tags/6.9.7/includes/class-feed-shortcode.php#L33"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3610853%40widget-google-reviews%2Ftrunk\u0026old=3606801%40widget-google-reviews%2Ftrunk"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-14T14:38:09.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-23T19:00:45.000Z",
"value": "Disclosed"
}
],
"title": "Rich Showcase for Google Reviews \u003c= 6.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via \u0027pagination\u0027 Shortcode Attribute"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-15739",
"datePublished": "2026-07-24T07:53:36.691Z",
"dateReserved": "2026-07-14T14:22:59.359Z",
"dateUpdated": "2026-07-24T14:24:07.142Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-12499 (GCVE-0-2025-12499)
Vulnerability from cvelistv5 – Published: 2025-12-06 07:29 – Updated: 2026-04-08 17:29
VLAI
EPSS
VEX
Title
Rich Shortcodes for Google Reviews <= 6.8 - Unauthenticated Stored Cross-Site Scripting via Google Review
Summary
The Rich Shortcodes for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the contents of a Google Review in all versions up to, and including, 6.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability was partially patched in version 6.6.2.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-12-08 21:26 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| widgetpack | Rich Showcase for Google Reviews |
Affected:
0 , ≤ 6.8
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-12499",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-08T21:26:30.864221Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-12-08T21:26:41.020Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Rich Showcase for Google Reviews",
"vendor": "widgetpack",
"versions": [
{
"lessThanOrEqual": "6.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Kishan Vyas"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Rich Shortcodes for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the contents of a Google Review in all versions up to, and including, 6.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability was partially patched in version 6.6.2."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T17:29:15.291Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e2960224-4446-4fc6-8d18-6f9911b4cbad?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3411521/widget-google-reviews"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3389203/widget-google-reviews"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-11-03T16:47:24.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2025-12-05T18:52:16.000Z",
"value": "Disclosed"
}
],
"title": "Rich Shortcodes for Google Reviews \u003c= 6.8 - Unauthenticated Stored Cross-Site Scripting via Google Review"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2025-12499",
"datePublished": "2025-12-06T07:29:11.782Z",
"dateReserved": "2025-10-29T23:43:41.517Z",
"dateUpdated": "2026-04-08T17:29:15.291Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-6884 (GCVE-0-2023-6884)
Vulnerability from cvelistv5 – Published: 2024-02-05 21:21 – Updated: 2026-04-08 17:13
VLAI
EPSS
VEX
Title
Plugin for Google Reviews <= 3.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode
Summary
This plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in all versions up to, and including, 3.1 due to insufficient input sanitization and output escaping on the 'place_id' attribute. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-02-11 18:22 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| widgetpack | Rich Showcase for Google Reviews |
Affected:
0 , ≤ 3.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-6884",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-11T18:22:12.831492Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:17:21.520Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T08:42:07.970Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a8971d54-b54e-4e62-9db2-fa87d2564599?source=cve"
},
{
"tags": [
"x_transferred"
],
"url": "https://plugins.svn.wordpress.org/widget-google-reviews/tags/3.1/includes/class-feed-shortcode.php"
},
{
"tags": [
"x_transferred"
],
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3018964%40widget-google-reviews\u0026new=3018964%40widget-google-reviews\u0026sfp_email=\u0026sfph_mail="
},
{
"tags": [
"x_transferred"
],
"url": "https://advisory.abay.sh/cve-2023-6884"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Rich Showcase for Google Reviews",
"vendor": "widgetpack",
"versions": [
{
"lessThanOrEqual": "3.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Akbar Kustirama"
}
],
"descriptions": [
{
"lang": "en",
"value": "This plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin\u0027s shortcode in all versions up to, and including, 3.1 due to insufficient input sanitization and output escaping on the \u0027place_id\u0027 attribute. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T17:13:55.206Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a8971d54-b54e-4e62-9db2-fa87d2564599?source=cve"
},
{
"url": "https://plugins.svn.wordpress.org/widget-google-reviews/tags/3.1/includes/class-feed-shortcode.php"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3018964%40widget-google-reviews\u0026new=3018964%40widget-google-reviews\u0026sfp_email=\u0026sfph_mail="
},
{
"url": "https://advisory.abay.sh/cve-2023-6884"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-01-12T00:00:00.000Z",
"value": "Disclosed"
}
],
"title": "Plugin for Google Reviews \u003c= 3.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2023-6884",
"datePublished": "2024-02-05T21:21:56.066Z",
"dateReserved": "2023-12-16T01:01:04.366Z",
"dateUpdated": "2026-04-08T17:13:55.206Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}