Stored Cross-Site Scripting Vulnerability in Google Reviews Plugin for WordPress
CVE-2026-2388

6.4MEDIUM

Key Information:

Vendor

WordPress
Status
Reviews And Rating – Google Reviews
Vendor
CVE Published:
26 August 2026

What is CVE-2026-2388?

The Reviews and Rating – Google Reviews plugin for WordPress is susceptible to Stored Cross-Site Scripting (XSS), allowing authenticated users with Contributor-level access and higher to inject arbitrary JavaScript code. This vulnerability arises from the improper handling of user input in the wp_display() shortcode handler, where user-defined HTML tags are improperly sanitized. Consequently, malicious scripts can be executed within user contexts when affected pages are accessed, leading to potential data theft and session hijacking.

Affected Version(s)

Reviews and Rating – Google Reviews 0 <= 5.10

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/g-business-rev...
https://plugins.trac.wordpress.org/browser/g-business-rev...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Muhammad Yudha - DJ
.