What is the CVSS score of EUVD-2026-48527?

EUVD-2026-48527 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Rich Showcase for Google Reviews EUVD-2026-48527

| CVE-2026-15739 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-24 Wordfence

GHSA-28x5-9357-94j7

WordPress XSS Google Rich Showcase For Google Reviews Wordpress Plugin

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

6.4 MEDIUM

Requires contributor-level authentication (PR:L), no user interaction; scope changed as injected script affects other users' browsers.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 12:22 vuln.today

CVE Published

Jul 24, 2026 - 07:53 cve.org

MEDIUM 6.4

DescriptionCVE.org

The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'pagination' Shortcode Attribute in all versions up to, and including, 6.9.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored cross-site scripting in the Rich Showcase for Google Reviews WordPress plugin allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts via the 'pagination' Shortcode Attribute. When a user accesses an injected page, the malicious scripts execute in their browser. No public exploit code has been identified, and exploitation is not confirmed in the wild.

Technical ContextAI

The vulnerability exists within the WordPress plugin 'Rich Showcase for Google Reviews' (vendor: widgetpack, CPE: cpe:2.3:a:widgetpack:rich_showcase_for_google_reviews:*:*:*:*:*:*:*:*) due to insufficient sanitization of the 'pagination' attribute in the plugin's shortcode handling code (class-view.php, class-feed-old.php, class-feed-shortcode.php). Classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), the flaw stems from the plugin failing to properly escape user-supplied input before rendering it in HTML, enabling stored XSS.

RemediationAI

Update the plugin to a version beyond 6.9.9. The vendor has released a patch, as indicated by the changeset (https://plugins.trac.wordpress.org/changeset?reponame=&new=3610853%40widget-google-reviews%2Ftrunk&old=3606801%40widget-google-reviews%2Ftrunk). No exact patched version number is specified, but upgrading to the latest available release will apply the fix. As a temporary workaround, restrict contributor-level access to shortcode insertion, but this may impair content creation processes.