EUVD-2026-43155
GHSA-qc9w-x5m9-8667
Severity by source
AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Network-accessible admin panel; AC:H for mandatory non-default deployment conditions; PR:H for required editor role; UI:R corrected from provided vector since a victim must visit the injected page for script execution; scope change and limited C/I impact preserved.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Widgets for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 13.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
AnalysisAI
Stored Cross-Site Scripting in the Widgets for Google Reviews WordPress plugin (versions ≤ 13.3) enables authenticated attackers holding editor-level WordPress roles to inject persistent JavaScript through admin settings, which then executes in any site visitor's browser on pages rendering the compromised widget. Exploitation is gated by two environmental prerequisites - multi-site WordPress deployments or single-site installs where unfiltered_html has been explicitly disabled - substantially narrowing the attack surface despite the network-accessible entry point. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the fix is referenced via a WordPress plugin repository changeset but an exact patched release version is not independently confirmed.
Technical ContextAI
The plugin, identified by CPE cpe:2.3:a:trustindex:widgets_for_google_reviews:*:*:*:*:*:*:*:*, is a Trustindex-authored WordPress plugin that embeds Google Reviews widgets on pages. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): attacker-controlled data submitted through admin settings is stored in the database without adequate sanitization and later rendered in page output without sufficient escaping. Wordfence references identify four specific vulnerable code locations: trustindex-plugin.class.php at lines 649 and 6551, and tabs/free-widget-configurator.php at lines 400 and 406. The scope change (S:C in CVSS) reflects that injected scripts execute in the victim's browser security context - outside the plugin's own origin - enabling cross-origin impact consistent with stored XSS.
RemediationAI
Update the Widgets for Google Reviews plugin to the version released after changeset 3584904 in the WordPress plugin repository (https://plugins.trac.wordpress.org/changeset?reponame=&old=3584904%40wp-reviews-plugin-for-google&new=3584904%40wp-reviews-plugin-for-google); an exact patched release number is not independently confirmed from available data, so verify the current version in the WordPress.org plugin directory changelog before deploying. As an interim compensating control on multi-site installations, restrict the Editor role from accessing Widgets for Google Reviews admin settings using a capability manager plugin (e.g., Members or User Role Editor) - note this may prevent legitimate widget configuration by editors and require an administrator to manage widget settings directly. On single-site installs where unfiltered_html is currently disabled, re-enabling unfiltered_html for editors eliminates the vulnerability condition but introduces broader HTML injection risk and should be weighed against the threat model. Deactivating the plugin entirely is the lowest-risk workaround where Google Reviews widgets are not business-critical.
More in Widgets For Google Reviews
View allSame weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today