Stored Cross-Site Scripting Flaw in Multiple WordPress Review Plugins
CVE-2026-125711
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 13 November 2026
Badges
What is CVE-2026-125711?
Multiple WordPress review plugins prior to version 14.3 are vulnerable to stored cross-site scripting (XSS) attacks. These vulnerabilities arise because the plugins do not properly sanitize and escape business details when rendered in review widgets. As a result, users with Editor roles or higher could exploit this flaw, potentially allowing them to execute malicious scripts even in environments where the 'unfiltered_html' capability is restricted. This can severely compromise the integrity of the website and its users.
Affected Version(s)
Review Widgets for Szallas.hu 0 < 14.3
Widgets for Airbnb Reviews 0 < 14.3
Widgets for Alibaba Reviews 0 < 14.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.