Rich Showcase for Google Reviews CVE-2026-100148

Requires a WordPress site running Rich Showcase for Google Reviews (widgetpack) ≤7.1.3 that is connected to a Google business profile and rendering imported reviews. Two delivery paths exist: (1) an authenticated user with subscriber-level access or above injecting via the 'reviews[].text' parameter (vendor PR:L), and (2) an unauthenticated attacker posting a crafted Google review on the connected business, which the plugin's default daily auto-import cron ingests with no WordPress credentials. Limiting factors: the malicious review only takes effect after the daily cron import (a delay, not a race), execution only occurs on pages that display the imported reviews, and the site must have the auto-import feature enabled (default) and the plugin connected to a business. Once stored, no user interaction is needed - it triggers for every visitor on DOMContentLoaded.

The vendor (Wordfence) CVSS 3.1 score is 6.4 (medium) using CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, reflecting an authenticated subscriber-level stored XSS. However, this score understates a key signal in the description: the payload can also be delivered with NO WordPress account by posting a crafted Google review for the connected business, which the plugin's default daily cron then auto-imports - this is effectively an unauthenticated injection path, conflicting with the vendor's PR:L and arguing for PR:N in real-world terms. Offsetting factors keep this from being a top-tier emergency: impact is limited (C:L/I:L, no availability or full compromise), it is a client-side script-execution flaw rather than server RCE, and the product is a niche plugin. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - do not treat it as weaponized. Net: a moderate-priority patch, elevated above a routine subscriber-XSS because the auto-import vector requires no account and the payload executes for every visitor with no user interaction, but bounded by limited technical impact and modest deployment footprint. EPSS and SSVC data are missing and should be checked to finalize prioritization.

An attacker posts a Google review containing a JavaScript payload on the business profile connected to the plugin; the plugin's default daily cron auto-imports the review text without sanitization. When any visitor loads a page displaying the imported reviews, the script executes on DOMContentLoaded with no further interaction, enabling session/cookie theft, redirects, or drive-by actions in the victim's browser. No public exploit code was identified in the provided data.