CVE-2026-100148
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'reviews[].text' parameter in all versions up to, and including, 7.1.3. An authenticated attacker with subscriber-level access or above can inject arbitrary web scripts that execute when a user visits the injected page.
Risk Assessment
An attacker can execute arbitrary JavaScript in visitors' browsers, potentially leading to session or data theft. The payload is delivered via a Google review and auto-imported by the daily cron, with execution triggering for every visitor without further interaction.
Recommendation
Update the plugin to a version newer than 7.1.3 when available, and consider disabling automatic Google review import or manually verifying content before publishing.
Other vulnerabilities in Rich Showcase for Google Reviews
Original NVD description (English source)
The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'reviews[].text' parameter in all versions up to, and including, 7.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is delivered entirely through a Google review posted for the connected business and requires no WordPress account; the plugin's default daily cron auto-imports the malicious review text, and execution triggers for every visitor on DOMContentLoaded without any further user interaction.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS