Stored Cross-Site Scripting Vulnerability in Widgets for Google Reviews Plugin by WordPress
CVE-2025-9436
6.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 11 December 2025
What is CVE-2025-9436?
The Widgets for Google Reviews plugin for WordPress presents a stored cross-site scripting vulnerability through the 'trustindex' shortcode. Due to inadequate input sanitization and output escaping mechanisms applied to user-supplied attributes, authenticated attackers with contributor-level access can exploit this flaw. They may inject arbitrary web scripts that execute whenever a user accesses the altered page, posing significant risks to site security and user data integrity.
Affected Version(s)
Widgets for Google Reviews * <= 13.2.1