What is the CVSS score of EUVD-2026-41894?

EUVD-2026-41894 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Reviews Widgets Plugin EUVD-2026-41894

| CVE-2026-12154 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-06 Wordfence

GHSA-7g4w-hpm5-fjj3

WordPress XSS Google Wordpress Plugin Reviews Widgets For Google Tripadvisor Yelp Recommendations

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

PR:L reflects required contributor auth; UI:R because a victim must visit the injected page; S:C for cross-context browser execution; no availability impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 06, 2026 - 18:34 vuln.today

CVE Published

Jul 06, 2026 - 17:31 nvd

MEDIUM 6.4

DescriptionCVE.org

The Reviews Widgets for Google, Yelp & TripAdvisor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'page_id' shortcode attribute of the [fbrev] shortcode in versions up to and including 2.7.3. This is due to insufficient input sanitization and output escaping in the Feed_Shortcode::fbrev() method, which passes the raw shortcode attribute through Feed_Old::get_feed() into the View::render() method, where it is echoed directly into the data-id HTML attribute without esc_attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the Reviews Widgets for Google, Yelp & TripAdvisor WordPress plugin (versions up to and including 2.7.3) allows authenticated attackers with contributor-level access to inject persistent malicious scripts into pages by abusing the 'page_id' attribute of the [fbrev] shortcode. The injected payload executes in the browsers of any user who subsequently visits the affected page, enabling session hijacking, credential theft, or further exploitation within the victim's browser context. No public exploit code has been identified at time of analysis, and no KEV listing is present, but the contributor-level access bar is low in multi-author WordPress deployments.

Technical ContextAI

The vulnerability is a CWE-79 (Improper Neutralization of Input During Web Page Generation) stored XSS rooted in a multi-method data-flow failure within the WordPress plugin identified by CPE cpe:2.3:a:widgetpack:reviews_widgets_for_google,_tripadvisor,_yelp_&_recommendations:*:*:*:*:*:*:*:*. Specifically, the [fbrev] shortcode handler in Feed_Shortcode::fbrev() (class-feed-shortcode.php:L57) accepts the raw 'page_id' attribute and passes it without sanitization into Feed_Old::get_feed() (class-feed-old.php:L55), which in turn supplies it to View::render() (class-view.php:L36). The terminal rendering step echoes the value directly into an HTML data-id attribute without invoking WordPress's esc_attr() escaping function. This three-hop taint path - shortcode input to HTML output with no escaping checkpoint - is the canonical pattern for stored XSS in WordPress plugin shortcode handlers. The scope change (S:C in the CVSS vector) reflects that payload execution occurs in the victim's browser security context, not the server's.

RemediationAI

An upstream code change is available via the WordPress plugin Trac changeset (revision 3593292 from 3451654 at plugins.trac.wordpress.org/changeset?new=3593292%40fb-reviews-widget&old=3451654%40fb-reviews-widget); however, the exact patched release version is not independently confirmed from the provided input data - upgrade to the latest available version from the WordPress plugin repository and verify the fix is present. As a compensating control pending upgrade, site administrators can disable the [fbrev] shortcode by deactivating or removing the plugin, eliminating the injection vector entirely at the cost of losing the review widget functionality. Restricting WordPress contributor role assignment to trusted users only limits the pool of potential attackers but does not remediate the underlying flaw. Input validation at the application firewall layer (blocking shortcode injection attempts) is an imprecise mitigation due to the wide variety of XSS payload encodings. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/86fbc499-dca3-41da-a6ef-8e97d7e46d0e should be monitored for a confirmed patched version number.