CVE-2026-12154: Stored XSS in WordPress Reviews Widgets Plugin—Patch Guidance

Technical summary

The vulnerability exists in the Feed_Shortcode::fbrev() method of the plugin. The 'page_id' shortcode attribute is passed through the Feed_Old::get_feed() and View::render() methods without proper sanitization or escaping. The flaw occurs when the attribute is echoed directly into the data-id HTML attribute without applying WordPress's esc_attr() escaping function. An attacker with contributor or above role can craft a shortcode containing JavaScript payload in the page_id parameter. Because the output is not escaped, the browser interprets the injected content as executable script rather than plain text, enabling stored XSS attacks that persist in the page's HTML. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation).

Business impact

Organizations relying on this plugin risk having their published content compromised without immediate visibility. Because the XSS is stored, every visitor to an affected page becomes a potential victim—leading to credential theft, malware distribution, or unauthorized actions performed on behalf of site visitors. For WordPress sites with user-generated content or community interactions, this could damage reputation and user trust. Incident response and remediation efforts would involve identifying all compromised pages, removing injected scripts, and potentially notifying affected users. The medium CVSS score reflects the requirement for authenticated access, but the stored nature of the attack and broad visitor impact elevate practical risk for most deployments.

Affected systems

The Reviews Widgets for Google, Yelp & TripAdvisor WordPress plugin is affected in versions up to and including 2.7.3. The vulnerability affects any WordPress site running this plugin version with users who have contributor-level or higher permissions (contributors, authors, editors, and administrators). Risk is proportional to how many trusted editors have access and whether external contributors are permitted to create or modify content.

Exploitability

Exploitability requires valid WordPress credentials with at least contributor-level access. No special tools or network-level interaction is needed beyond normal WordPress editing workflows. An attacker must craft a shortcode with a malicious 'page_id' attribute and insert it into a published page or post. The attack then activates automatically when the page is accessed—no user interaction or social engineering is required beyond the initial shortcode injection. This is a relatively straightforward attack once authenticated access is obtained, making it moderately exploitable for insiders or compromised contributor accounts.

Remediation

Update the Reviews Widgets for Google, Yelp & TripAdvisor plugin to a patched version beyond 2.7.3. Check the plugin's official repository or vendor advisory for the specific version number that addresses this vulnerability. After updating, review your plugin's access permissions and audit which user accounts have contributor or higher roles, particularly those that are no longer actively used. Consider implementing additional input validation and output escaping practices as defense-in-depth measures. For sites that cannot update immediately, consider temporarily disabling the plugin if it is not critical to operations.

Patch guidance

Apply the latest version of the Reviews Widgets for Google, Yelp & TripAdvisor plugin released after July 7, 2026 (the modification date of this advisory). Verify the exact patched version number against the plugin's official repository or vendor security advisory before deploying. Test the update in a staging environment first to ensure compatibility with your site and other installed plugins. After patching, verify that all shortcode functionality operates as expected and that no malicious content was injected during the vulnerability window. Monitor access logs for any suspicious shortcode usage patterns during the vulnerable period.

Detection guidance

Search your WordPress database and page/post content for instances of [fbrev] shortcodes with unusual or suspicious 'page_id' parameter values. Look for shortcodes that contain script tags, event handlers (onclick, onload, etc.), or encoded payloads within the attribute. Review contributor and author user accounts for recent activity, particularly those created recently or with unexplained changes in post history. Monitor web server and application logs for requests to pages containing the plugin's shortcode after the vulnerability publication date. Use WordPress security plugins or custom queries to audit all [fbrev] shortcode attributes across your site. Any pages published or modified during a known compromise window should be prioritized for manual inspection.

Why prioritize this

This vulnerability warrants prompt attention because it enables persistent malicious content injection into public-facing pages accessed by all site visitors. The stored XSS nature means the threat does not depend on social engineering or user action—it simply executes on page load. Organizations with multiple editors or contributor accounts face elevated risk of internal exploitation. While the medium CVSS score reflects the authenticated prerequisite, the practical business impact of compromised site content and potential visitor compromise justifies prioritizing patching before external threats can be leveraged. The July 2026 publication date means this is actively known and may be under scrutiny by threat actors.

Risk score, explained

The CVSS 3.1 score of 6.4 (MEDIUM) reflects a combination of factors: the attack vector is network-accessible (AV:N), requires low attack complexity (AC:L), and needs prior authentication (PR:L—low privilege, contributor role). The impact is limited to confidentiality and integrity of the affected scope (C:L, I:L) with no availability impact (A:N). The score does not account for the persistence of stored XSS or the fact that remediation may be operationally challenging on large sites. Practical risk should be evaluated higher if your organization has multiple trusted contributors or if the plugin is critical to your content strategy. The lack of CVSS availability impact reflects that the vulnerability does not crash systems, but stored XSS can still disrupt business operations and user trust significantly.

Frequently asked questions