Cross-Site Scripting Vulnerability in Rich Showcase for Google Reviews Plugin by WordPress

CVE-2026-100148

What is CVE-2026-100148?

The Rich Showcase for Google Reviews plugin for WordPress has a vulnerability that allows for Stored Cross-Site Scripting through the 'reviews[].text' parameter. This weakness stems from inadequate input sanitization and output escaping, which enables authenticated attackers with subscriber-level access or higher to insert malicious scripts into pages. The attack is executed via a Google review, which the plugin's default daily cron job auto-imports, causing the malicious review text to be rendered each time a user visits the affected page. The payload activates upon the DOMContentLoaded event, requiring no additional interaction from users, making it a significant security concern for websites utilizing this plugin.

References