EUVD-2026-49241
GHSA-vf3j-r252-rjfm
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Primary rating from Vendor (Patchstack) · only source for this CVE.
CVSS VectorVendor: Patchstack
Lifecycle Timeline
1DescriptionCVE.org
Unauthenticated Cross Site Request Forgery (CSRF) in WP Google Review Slider <= 18.4 versions.
AnalysisAI
Cross-site request forgery in WP Google Review Slider versions up to 18.4 allows unauthenticated attackers to trick logged-in administrators into performing unintended actions, such as modifying plugin settings or injecting content. The vulnerability is rated medium severity (CVSS 4.3) because it requires user interaction and has only a low integrity impact. No active exploitation or public exploit code has been identified at this time.
More in Wp Google Review Slider
View allThe WP Google Review Slider WordPress plugin before 11.8 does not properly sanitise and escape a parameter before using
The WP Google Review Slider WordPress plugin before 13.6 does not sanitise and escape some of its settings, which could
The WP Google Review Slider WordPress plugin before 11.6 does not sanitise and escape some of its settings, which could
We have the CVE-2026-66427 description: "Administrator SQL Injection in WP Google Review Slider <= 18.4 versions." CVSS
Unauthenticated cross-site scripting in the WP Google Review Slider WordPress plugin (versions up to and including 18.0)
Reflected Cross-Site Scripting in Wp Google Places Review Slider (WordPress plugin, versions ≤ 18.1) allows unauthentica
The WP Google Review Slider WordPress plugin before 15.6 does not sanitise and escape some of its settings, which could
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today