CVE-2026-12154
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
The Reviews Widgets for Google, Yelp & TripAdvisor plugin for WordPress up to version 2.7.3 is vulnerable to stored XSS. Authenticated attackers with contributor-level access or higher can inject arbitrary scripts via the 'page_id' attribute of the [fbrev] shortcode.
Risk Assessment
The risk involves execution of malicious scripts in the browser of an administrator or user, potentially leading to session theft, account takeover, or website defacement.
Recommendation
Immediately update the plugin to the latest patched version and restrict user permissions to the minimum necessary.
Original NVD description (English source)
The Reviews Widgets for Google, Yelp & TripAdvisor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'page_id' shortcode attribute of the [fbrev] shortcode in versions up to and including 2.7.3. This is due to insufficient input sanitization and output escaping in the Feed_Shortcode::fbrev() method, which passes the raw shortcode attribute through Feed_Old::get_feed() into the View::render() method, where it is echoed directly into the data-id HTML attribute without esc_attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.