Stored Cross-Site Scripting Vulnerability in Rich Showcase for Google Reviews Plugin

CVE-2026-15739

What is CVE-2026-15739?

The Rich Showcase for Google Reviews plugin for WordPress is susceptible to a stored cross-site scripting vulnerability due to inadequate input sanitization and output escaping via the 'pagination' shortcode attribute in all versions up to and including 6.9.9. This vulnerability allows authenticated attackers with contributor-level access and higher to inject malicious scripts into pages. When a user accesses an affected page, these scripts may execute within their browser context, potentially compromising user data and site integrity.

References