Description

The Reviews and Rating – Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.10. This is due to the wp_display() shortcode handler, used by multiple shortcodes, allowing attacker-controlled html_tags values to define raw HTML tags and then embedding untrusted vicinity content inside those tags. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-08-26T10:16:40.447Z",
  "pubdate": "2026-08-26T10:16:40.447Z",
  "executiveSummary": "The Reviews and Rating – Google Reviews WordPress plugin is affected by a Stored Cross-Site Scripting (XSS) vulnerability in versions up to and including 5.10.\nThe vulnerability originates from the improper sanitization of user-supplied input within the plugin's shortcode functionality.\nAn authenticated attacker with Contributor-level access or higher can inject malicious JavaScript payloads, which are stored within the WordPress database.\nWhen a victim, including administrators, views a page containing the compromised shortcode, the stored malicious script executes within the context of the user's browser session.\nSuccessful exploitation allows for unauthorized actions, session hijacking, credential theft, and the potential compromise of the WordPress installation.\nThis vulnerability poses a significant risk to site integrity and user data privacy due to the persistent nature of stored XSS, requiring elevated privileges for initial exploitation.",
  "technicalDetails": "The vulnerability exists within the wp_display() function, which serves as the core handler for the plugin's shortcode implementation.\nThe root cause is the failure of the application to properly sanitize and validate the 'html_tags' parameter passed to the shortcode before rendering it in the final HTML output.\nBy manipulating the 'html_tags' attribute, an attacker can define arbitrary raw HTML tags, effectively breaking out of the intended structural constraints and injecting malicious payloads.\nThe exploitation flow begins with an authenticated attacker, holding at least Contributor-level privileges, creating or editing a post or page containing the vulnerable shortcode. The attacker inserts a malicious payload into the 'html_tags' parameter (e.g., using <script> or event handlers like 'onload' or 'onerror').\nOnce the page is saved, the malicious payload is persisted into the WordPress database as part of the post content.\nWhen a legitimate user or administrator visits the page, the wp_display() function retrieves the stored malicious string and renders it directly into the HTML response without adequate output encoding.\nConsequently, the browser interprets the injected script as valid code, executing it within the security context of the user's session on the target domain.\nBecause the payload is stored, this remains persistent across page loads until the content is manually removed by an authorized user.\nThe impact includes the ability to perform unauthorized requests on behalf of the victim, bypass CSRF protections, exfiltrate sensitive cookies or session tokens, and potentially escalate privileges if the victim is an administrator.\nGiven that WordPress contributors can create content, the barrier to exploitation is low for internal actors or compromised accounts."
}