Wp Google Review Slider
Monthly
Cross-site request forgery in WP Google Review Slider versions up to 18.4 allows unauthenticated attackers to trick logged-in administrators into performing unintended actions, such as modifying plugin settings or injecting content. The vulnerability is rated medium severity (CVSS 4.3) because it requires user interaction and has only a low integrity impact. No active exploitation or public exploit code has been identified at this time.
We have the CVE-2026-66427 description: "Administrator SQL Injection in WP Google Review Slider <= 18.4 versions." CVSS 3.1 vector given: AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L. Score 7.6. CWE: CWE-89 (SQL Injection) Multi-source intelligence: patchstack reported, CPE string: cpe:2.3:a:jgwhite33:wp_google_review_slider:*:*:*:*:*:*:*:* Tags: SQLi, Google, Wp Google Review Slider SSVC: Exploitation: none, Automatable: no, Technical Impact: partial EUVD references: affected versions: WP Google Review Slider n/a ≤18.4. References: patchstack database link, and nvd.nist.gov link (but that is likely not the official NVD because that CVE is 2026, maybe placeholder). The task: Synthesize into JSON fields. product_name: "WP Google Review Slider" (1-3 words, the plugin name). So output: "WP Google Review Slider" summary: 2-3 sentence plain-language. Not copy description. Original synthesis. Start with specific impact verb: "Authenticated SQL injection in WP Google Review Slider plugin up to version 18.4 allows..." But the CVSS vector is PR:H, meaning high privileges (administrator). So authenticated as admin. Impact: CVSS vector says C:H (high confidentiality), I:N (no integrity), A:L (low availability). So it reads data, possibly denial of service partial. Not actively exploited (SSVC exploitation none, no KEV). POC status unknown. EPSS not given. But EPSS score is missing from input, we have no EPSS. So in summary, mention that it's a SQL injection by admin. Not start with "A vulnerability". Example: "Authenticated SQL injection in WP Google Review Slider versions ≤18.4 enables administrators to read database contents, potentially exposing sensitive user data. The vulnerability, reported by Patchstack, does not appear to be actively exploited and requires high privileges, limiting risk to trusted users." technical_context: Explain the technology: WordPress plugin, likely uses SQL queries to store/retrieve review data. CWE-89, insufficient sanitization of user-supplied input
Reflected Cross-Site Scripting in Wp Google Places Review Slider (WordPress plugin, versions ≤ 18.1) allows unauthenticated remote attackers to inject arbitrary JavaScript via the unsanitized `place` GET parameter in `admin/partials/googlecrawl_dfs.php`. The raw user input is URL-decoded and passed through `stripslashes()` before being echoed directly into an HTML value attribute — bypassing WordPress's standard `esc_attr()` — but only when the supplied place value is not already present as a key in the `wprev_google_crawls` stored option. No public exploit identified at time of analysis; successful exploitation requires tricking an authenticated WordPress administrator into clicking a specially crafted link.
Unauthenticated cross-site scripting in the WP Google Review Slider WordPress plugin (versions up to and including 18.0) allows a remote, unauthenticated attacker to inject arbitrary JavaScript that executes in the browser of any user who interacts with the affected page. Reported by Patchstack and tracked as EUVD-2026-36930, the vulnerability stems from improper input sanitization in a publicly accessible plugin component. No public exploit code or CISA KEV listing has been identified at the time of analysis, placing this in the medium-priority tier despite the unauthenticated attack vector.
The WP Google Review Slider WordPress plugin before 15.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The WP Google Review Slider WordPress plugin before 13.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting. Rated medium severity (CVSS 5.9), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The WP Google Review Slider WordPress plugin before 11.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The WP Google Review Slider WordPress plugin before 11.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Cross-site request forgery in WP Google Review Slider versions up to 18.4 allows unauthenticated attackers to trick logged-in administrators into performing unintended actions, such as modifying plugin settings or injecting content. The vulnerability is rated medium severity (CVSS 4.3) because it requires user interaction and has only a low integrity impact. No active exploitation or public exploit code has been identified at this time.
We have the CVE-2026-66427 description: "Administrator SQL Injection in WP Google Review Slider <= 18.4 versions." CVSS 3.1 vector given: AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L. Score 7.6. CWE: CWE-89 (SQL Injection) Multi-source intelligence: patchstack reported, CPE string: cpe:2.3:a:jgwhite33:wp_google_review_slider:*:*:*:*:*:*:*:* Tags: SQLi, Google, Wp Google Review Slider SSVC: Exploitation: none, Automatable: no, Technical Impact: partial EUVD references: affected versions: WP Google Review Slider n/a ≤18.4. References: patchstack database link, and nvd.nist.gov link (but that is likely not the official NVD because that CVE is 2026, maybe placeholder). The task: Synthesize into JSON fields. product_name: "WP Google Review Slider" (1-3 words, the plugin name). So output: "WP Google Review Slider" summary: 2-3 sentence plain-language. Not copy description. Original synthesis. Start with specific impact verb: "Authenticated SQL injection in WP Google Review Slider plugin up to version 18.4 allows..." But the CVSS vector is PR:H, meaning high privileges (administrator). So authenticated as admin. Impact: CVSS vector says C:H (high confidentiality), I:N (no integrity), A:L (low availability). So it reads data, possibly denial of service partial. Not actively exploited (SSVC exploitation none, no KEV). POC status unknown. EPSS not given. But EPSS score is missing from input, we have no EPSS. So in summary, mention that it's a SQL injection by admin. Not start with "A vulnerability". Example: "Authenticated SQL injection in WP Google Review Slider versions ≤18.4 enables administrators to read database contents, potentially exposing sensitive user data. The vulnerability, reported by Patchstack, does not appear to be actively exploited and requires high privileges, limiting risk to trusted users." technical_context: Explain the technology: WordPress plugin, likely uses SQL queries to store/retrieve review data. CWE-89, insufficient sanitization of user-supplied input
Reflected Cross-Site Scripting in Wp Google Places Review Slider (WordPress plugin, versions ≤ 18.1) allows unauthenticated remote attackers to inject arbitrary JavaScript via the unsanitized `place` GET parameter in `admin/partials/googlecrawl_dfs.php`. The raw user input is URL-decoded and passed through `stripslashes()` before being echoed directly into an HTML value attribute — bypassing WordPress's standard `esc_attr()` — but only when the supplied place value is not already present as a key in the `wprev_google_crawls` stored option. No public exploit identified at time of analysis; successful exploitation requires tricking an authenticated WordPress administrator into clicking a specially crafted link.
Unauthenticated cross-site scripting in the WP Google Review Slider WordPress plugin (versions up to and including 18.0) allows a remote, unauthenticated attacker to inject arbitrary JavaScript that executes in the browser of any user who interacts with the affected page. Reported by Patchstack and tracked as EUVD-2026-36930, the vulnerability stems from improper input sanitization in a publicly accessible plugin component. No public exploit code or CISA KEV listing has been identified at the time of analysis, placing this in the medium-priority tier despite the unauthenticated attack vector.
The WP Google Review Slider WordPress plugin before 15.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The WP Google Review Slider WordPress plugin before 13.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting. Rated medium severity (CVSS 5.9), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The WP Google Review Slider WordPress plugin before 11.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The WP Google Review Slider WordPress plugin before 11.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.