CVE-2025-9436

MediumCVSS 6.4

Published: 11/12/2025(UTC)Updated: 08/10/2026(UTC)Translated: 30/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

13th percentile - higher than 13% of all known CVEs

Summary

The Widgets for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `trustindex` shortcode in all versions up to and including 13.2.1 due to insufficient input sanitization and output escaping on user supplied attributes.

Risk Assessment

Authenticated attackers with contributor-level access can inject arbitrary web scripts that execute when a user accesses an injected page, potentially leading to data theft or session hijacking.

Recommendation

Update the Widgets for Google Reviews plugin to the latest version. Restrict access to low-privilege accounts and regularly audit content.

Other vulnerabilities in Widgets for Google Reviews

CVE-2026-11591Medium
The Widgets for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to 13.3. This is due to insufficient input sanitization and output escaping. Authenticated attackers with editor-level permissions or higher can inject arbitrary scripts that execute when users access affected pages.

Original NVD description (English source)

The Widgets for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `trustindex` shortcode in all versions up to, and including, 13.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS