Fb Reviews Widget Vulnerabilities

The Reviews Widgets for Google, Yelp & TripAdvisor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'page_id' shortcode attribute of the [fbrev] shortcode in versions up to and including 2.7.3. This is due to insufficient input sanitization and output escaping in the Feed_Shortcode::fbrev() met...

CVSS:

6.4

Affected:

up to 2.7.3

Fixed in:

2.8

Disclosed:

Jul 2, 2026

CVE-2026-12154 on NVD →

[en] The Social Reviews & Recommendations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in the 'trim_text' function in all versions up to, and including, 2.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inj...

Affected:

up to 2.6

Fixed in:

2.6

Disclosed:

Dec 9, 2025

CVE-2025-12705 on NVD →

The Social Reviews & Recommendations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in the 'trim_text' function in all versions up to, and including, 2.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject a...

CVSS:

7.2

Affected:

up to 2.5

Fixed in:

2.6

Disclosed:

Dec 8, 2025

CVE-2025-12705 on NVD →

The Social Reviews & Recommendations plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.

CVSS:

4.3

Affected:

up to 2.3

Fixed in:

2.4

Disclosed:

Mar 27, 2025

CVE-2025-30883 on NVD →

[en] Missing Authorization vulnerability in richplugins Trust.Reviews allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Trust.Reviews: from n/a through 2.3.

Affected:

up to 2.4

Fixed in:

2.4

Disclosed:

Mar 27, 2025

CVE-2025-30883 on NVD →