G Business Reviews Rating Vulnerabilities

The Reviews and Rating – Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.10. This is due to the wp_display() shortcode handler, used by multiple shortcodes, allowing attacker-controlled html_tags values to define raw HTML tags and then embedding u...

CVSS:

6.4

Affected:

up to 5.10

Fix:

No patched version reported

Disclosed:

Aug 25, 2026

CVE-2026-2388 on NVD →

The Reviews and Rating – Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file upload feature in all versions up to, and including, 5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level acces...

CVSS:

6.4

Affected:

up to 5.2

Fixed in:

5.3

Disclosed:

May 24, 2024

CVE-2024-5218 on NVD →

The Reviews and Rating – Google My Business plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on several functions in versions up to, and including, 4.14. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to modify restricted data...

CVSS:

8.3

Affected:

4.14 – 4.14

Fixed in:

4.15

Disclosed:

Jan 20, 2023

CVE-2023-23986 on NVD →