Stored Cross-Site Scripting in Widgets for Google Reviews Plugin by WordPress

CVE-2025-12510

What is CVE-2025-12510?

The Widgets for Google Reviews plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability due to inadequate input sanitization and output escaping of imported Google Reviews data. This security gap allows unauthenticated attackers to inject malicious scripts that may be executed in the administrator panel and potentially on the front end when users access affected reviews. Attackers can exploit this vulnerability by submitting a harmful review to a Google Place linked to the impacted site, which poses significant risks to site integrity and user safety.

References