Stored Cross-Site Scripting in Rich Shortcodes for Google Reviews Plugin by WordPress

CVE-2025-12499

What is CVE-2025-12499?

The Rich Shortcodes for Google Reviews plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping. This vulnerability allows unauthenticated attackers to exploit Google Review content, injecting malicious web scripts that execute when users access compromised pages. Although a partial patch for this issue was released in version 6.6.2, users are advised to upgrade to the latest version to ensure full protection.

References