Wp Reviews Plugin For Google Vulnerabilities

The Widgets for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 13.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and above, to injec...

CVSS:

4.4

Affected:

up to 13.3

Fixed in:

13.3.1

Disclosed:

Jul 10, 2026

CVE-2026-11591 on NVD →

The Widgets for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `trustindex` shortcode in all versions up to, and including, 13.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers...

CVSS:

6.4

Affected:

up to 13.2.1

Fixed in:

13.2.2

Disclosed:

Dec 10, 2025

CVE-2025-9436 on NVD →

The Widgets for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 13.2.4 due to insufficient input sanitization and output escaping on Google Reviews data imported by the plugin. This makes it possible for unauthenticated attackers to inject arbitrary...

CVSS:

7.2

Affected:

up to 13.2.4

Fixed in:

13.2.5

Disclosed:

Dec 5, 2025

CVE-2025-12510 on NVD →

Multiple plugins for WordPress by Trustindex.io are vulnerable to arbitrary file uploads due to missing file type validation in the ~/tabs/feature_request.php file in various versions. This makes it possible for authenticated attackers, with editor-level access and above, to upload arbitrary files on the affected site'...

CVSS:

6.6

Affected:

up to 11.0.2

Fixed in:

11.1

Disclosed:

Nov 22, 2023

CVE-2023-48275 on NVD →

The Widgets for Google Reviews plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 10.9. This is due to missing or incorrect nonce validation within setup_no_reg_header.php. This makes it possible for unauthenticated attackers to reset plugin settings and remove reviews vi...

CVSS:

4.3

Affected:

up to 10.9

Fixed in:

10.9.1

Disclosed:

Oct 16, 2023

CVE-2023-3254 on NVD →

The Widgets for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in versions up to, and including, 9.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor l...

CVSS:

6.4

Affected:

up to 9.7.1

Fixed in:

9.8

Disclosed:

Jan 5, 2023

CVE-2022-4470 on NVD →