CVE-2026-66428
MediumCVSS 4.3Summary
The WP Google Review Slider plugin version 18.4 and earlier contains a Cross-Site Request Forgery (CSRF) vulnerability without authentication. An attacker can trick an administrator into performing unwanted actions.
Risk Assessment
The risk involves the possibility of unauthorized operations in the context of an administrator session, potentially leading to plugin settings changes or data theft.
Recommendation
It is recommended to immediately update the WP Google Review Slider plugin to the latest available version that fixes this vulnerability.
Other vulnerabilities in WP Google Review Slider
See all- CVE-2026-66427High
SQL Injection vulnerability in the admin panel of WP Google Review Slider plugin up to version 18.4. Allows an administrator to execute arbitrary SQL queries.
- CVE-2026-39451Medium
The WP Google Review Slider plugin versions up to 18.0 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can exploit this flaw to inject malicious JavaScript code.
Original NVD description (English source)
Unauthenticated Cross Site Request Forgery (CSRF) in WP Google Review Slider <= 18.4 versions.