CVE-2026-39451
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
The WP Google Review Slider plugin versions up to 18.0 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can exploit this flaw to inject malicious JavaScript code.
Risk Assessment
This vulnerability may lead to user data theft and session hijacking, posing a serious threat to the application's security and the organization's data.
Recommendation
It is recommended to update the WP Google Review Slider plugin to the latest version to mitigate this security issue.
Other vulnerabilities in WP Google Review Slider
See all- CVE-2026-66428Medium
The WP Google Review Slider plugin version 18.4 and earlier contains a Cross-Site Request Forgery (CSRF) vulnerability without authentication. An attacker can trick an administrator into performing unwanted actions.
- CVE-2026-66427High
SQL Injection vulnerability in the admin panel of WP Google Review Slider plugin up to version 18.4. Allows an administrator to execute arbitrary SQL queries.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in WP Google Review Slider <= 18.0 versions.