Jgwhite33
Monthly
We have the CVE-2026-66427 description: "Administrator SQL Injection in WP Google Review Slider <= 18.4 versions." CVSS 3.1 vector given: AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L. Score 7.6. CWE: CWE-89 (SQL Injection) Multi-source intelligence: patchstack reported, CPE string: cpe:2.3:a:jgwhite33:wp_google_review_slider:*:*:*:*:*:*:*:* Tags: SQLi, Google, Wp Google Review Slider SSVC: Exploitation: none, Automatable: no, Technical Impact: partial EUVD references: affected versions: WP Google Review Slider n/a ≤18.4. References: patchstack database link, and nvd.nist.gov link (but that is likely not the official NVD because that CVE is 2026, maybe placeholder). The task: Synthesize into JSON fields. product_name: "WP Google Review Slider" (1-3 words, the plugin name). So output: "WP Google Review Slider" summary: 2-3 sentence plain-language. Not copy description. Original synthesis. Start with specific impact verb: "Authenticated SQL injection in WP Google Review Slider plugin up to version 18.4 allows..." But the CVSS vector is PR:H, meaning high privileges (administrator). So authenticated as admin. Impact: CVSS vector says C:H (high confidentiality), I:N (no integrity), A:L (low availability). So it reads data, possibly denial of service partial. Not actively exploited (SSVC exploitation none, no KEV). POC status unknown. EPSS not given. But EPSS score is missing from input, we have no EPSS. So in summary, mention that it's a SQL injection by admin. Not start with "A vulnerability". Example: "Authenticated SQL injection in WP Google Review Slider versions ≤18.4 enables administrators to read database contents, potentially exposing sensitive user data. The vulnerability, reported by Patchstack, does not appear to be actively exploited and requires high privileges, limiting risk to trusted users." technical_context: Explain the technology: WordPress plugin, likely uses SQL queries to store/retrieve review data. CWE-89, insufficient sanitization of user-supplied input
SQL injection in the WP TripAdvisor Review Slider WordPress plugin (all versions through 14.3) enables authenticated administrators to extract arbitrary data from the underlying WordPress database via a maliciously crafted `curselrevs[]` array parameter. The flaw stems from insufficient escaping and improper SQL query preparation in the plugin's admin-side code, documented at specific lines in the plugin's source on the WordPress repository. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified; real-world risk is substantially constrained by the administrator-level privilege requirement reflected in the CVSS 4.9 Medium score.
Cross-site request forgery in WP Google Review Slider versions up to 18.4 allows unauthenticated attackers to trick logged-in administrators into performing unintended actions, such as modifying plugin settings or injecting content. The vulnerability is rated medium severity (CVSS 4.3) because it requires user interaction and has only a low integrity impact. No active exploitation or public exploit code has been identified at this time.
SQL Injection in the WP TripAdvisor Review Slider WordPress plugin (all versions through 14.6) allows authenticated attackers holding administrator-level credentials to append arbitrary SQL to existing queries via the unsanitized 'filtersource' parameter, exposing sensitive data stored in the WordPress database. The flaw originates from insufficient escaping and missing prepared statement usage across multiple display and admin class files identified by Wordfence. No public exploit code or active exploitation has been identified at time of analysis, and the high privilege requirement significantly constrains real-world impact.
Reflected Cross-Site Scripting in Wp Google Places Review Slider (WordPress plugin, versions ≤ 18.1) allows unauthenticated remote attackers to inject arbitrary JavaScript via the unsanitized `place` GET parameter in `admin/partials/googlecrawl_dfs.php`. The raw user input is URL-decoded and passed through `stripslashes()` before being echoed directly into an HTML value attribute — bypassing WordPress's standard `esc_attr()` — but only when the supplied place value is not already present as a key in the `wprev_google_crawls` stored option. No public exploit identified at time of analysis; successful exploitation requires tricking an authenticated WordPress administrator into clicking a specially crafted link.
Unauthenticated cross-site scripting in the WP Google Review Slider WordPress plugin (versions up to and including 18.0) allows a remote, unauthenticated attacker to inject arbitrary JavaScript that executes in the browser of any user who interacts with the affected page. Reported by Patchstack and tracked as EUVD-2026-36930, the vulnerability stems from improper input sanitization in a publicly accessible plugin component. No public exploit code or CISA KEV listing has been identified at the time of analysis, placing this in the medium-priority tier despite the unauthenticated attack vector.
WordPress Plugin Google Review Slider 6.1 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A Stored Cross-Site Scripting (XSS) vulnerability exists in the WP Review Slider plugin (also known as wp-facebook-reviews) versions 13.9 and earlier, allowing attackers to inject malicious scripts that persist in the application and execute in users' browsers. This vulnerability affects WordPress site administrators and users who interact with review content. An attacker can exploit this to steal session tokens, deface content, redirect users to malicious sites, or perform actions on behalf of compromised users.
A Stored Cross-Site Scripting (XSS) vulnerability exists in the WP TripAdvisor Review Slider WordPress plugin through version 14.1, allowing attackers to inject malicious scripts that persist in the database and execute in the browsers of site visitors. The vulnerability affects all versions up to and including 14.1, and an attacker with sufficient privileges to inject content can compromise user sessions, steal credentials, or perform arbitrary actions on behalf of site administrators. No CVSS score or EPSS data is currently available, and active exploitation status via KEV is unknown, but Patchstack has documented this as a confirmed vulnerability with a reference implementation.
We have the CVE-2026-66427 description: "Administrator SQL Injection in WP Google Review Slider <= 18.4 versions." CVSS 3.1 vector given: AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L. Score 7.6. CWE: CWE-89 (SQL Injection) Multi-source intelligence: patchstack reported, CPE string: cpe:2.3:a:jgwhite33:wp_google_review_slider:*:*:*:*:*:*:*:* Tags: SQLi, Google, Wp Google Review Slider SSVC: Exploitation: none, Automatable: no, Technical Impact: partial EUVD references: affected versions: WP Google Review Slider n/a ≤18.4. References: patchstack database link, and nvd.nist.gov link (but that is likely not the official NVD because that CVE is 2026, maybe placeholder). The task: Synthesize into JSON fields. product_name: "WP Google Review Slider" (1-3 words, the plugin name). So output: "WP Google Review Slider" summary: 2-3 sentence plain-language. Not copy description. Original synthesis. Start with specific impact verb: "Authenticated SQL injection in WP Google Review Slider plugin up to version 18.4 allows..." But the CVSS vector is PR:H, meaning high privileges (administrator). So authenticated as admin. Impact: CVSS vector says C:H (high confidentiality), I:N (no integrity), A:L (low availability). So it reads data, possibly denial of service partial. Not actively exploited (SSVC exploitation none, no KEV). POC status unknown. EPSS not given. But EPSS score is missing from input, we have no EPSS. So in summary, mention that it's a SQL injection by admin. Not start with "A vulnerability". Example: "Authenticated SQL injection in WP Google Review Slider versions ≤18.4 enables administrators to read database contents, potentially exposing sensitive user data. The vulnerability, reported by Patchstack, does not appear to be actively exploited and requires high privileges, limiting risk to trusted users." technical_context: Explain the technology: WordPress plugin, likely uses SQL queries to store/retrieve review data. CWE-89, insufficient sanitization of user-supplied input
SQL injection in the WP TripAdvisor Review Slider WordPress plugin (all versions through 14.3) enables authenticated administrators to extract arbitrary data from the underlying WordPress database via a maliciously crafted `curselrevs[]` array parameter. The flaw stems from insufficient escaping and improper SQL query preparation in the plugin's admin-side code, documented at specific lines in the plugin's source on the WordPress repository. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified; real-world risk is substantially constrained by the administrator-level privilege requirement reflected in the CVSS 4.9 Medium score.
Cross-site request forgery in WP Google Review Slider versions up to 18.4 allows unauthenticated attackers to trick logged-in administrators into performing unintended actions, such as modifying plugin settings or injecting content. The vulnerability is rated medium severity (CVSS 4.3) because it requires user interaction and has only a low integrity impact. No active exploitation or public exploit code has been identified at this time.
SQL Injection in the WP TripAdvisor Review Slider WordPress plugin (all versions through 14.6) allows authenticated attackers holding administrator-level credentials to append arbitrary SQL to existing queries via the unsanitized 'filtersource' parameter, exposing sensitive data stored in the WordPress database. The flaw originates from insufficient escaping and missing prepared statement usage across multiple display and admin class files identified by Wordfence. No public exploit code or active exploitation has been identified at time of analysis, and the high privilege requirement significantly constrains real-world impact.
Reflected Cross-Site Scripting in Wp Google Places Review Slider (WordPress plugin, versions ≤ 18.1) allows unauthenticated remote attackers to inject arbitrary JavaScript via the unsanitized `place` GET parameter in `admin/partials/googlecrawl_dfs.php`. The raw user input is URL-decoded and passed through `stripslashes()` before being echoed directly into an HTML value attribute — bypassing WordPress's standard `esc_attr()` — but only when the supplied place value is not already present as a key in the `wprev_google_crawls` stored option. No public exploit identified at time of analysis; successful exploitation requires tricking an authenticated WordPress administrator into clicking a specially crafted link.
Unauthenticated cross-site scripting in the WP Google Review Slider WordPress plugin (versions up to and including 18.0) allows a remote, unauthenticated attacker to inject arbitrary JavaScript that executes in the browser of any user who interacts with the affected page. Reported by Patchstack and tracked as EUVD-2026-36930, the vulnerability stems from improper input sanitization in a publicly accessible plugin component. No public exploit code or CISA KEV listing has been identified at the time of analysis, placing this in the medium-priority tier despite the unauthenticated attack vector.
WordPress Plugin Google Review Slider 6.1 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A Stored Cross-Site Scripting (XSS) vulnerability exists in the WP Review Slider plugin (also known as wp-facebook-reviews) versions 13.9 and earlier, allowing attackers to inject malicious scripts that persist in the application and execute in users' browsers. This vulnerability affects WordPress site administrators and users who interact with review content. An attacker can exploit this to steal session tokens, deface content, redirect users to malicious sites, or perform actions on behalf of compromised users.
A Stored Cross-Site Scripting (XSS) vulnerability exists in the WP TripAdvisor Review Slider WordPress plugin through version 14.1, allowing attackers to inject malicious scripts that persist in the database and execute in the browsers of site visitors. The vulnerability affects all versions up to and including 14.1, and an attacker with sufficient privileges to inject content can compromise user sessions, steal credentials, or perform arbitrary actions on behalf of site administrators. No CVSS score or EPSS data is currently available, and active exploitation status via KEV is unknown, but Patchstack has documented this as a confirmed vulnerability with a reference implementation.