Security Alert Summary
The Reviews and Rating – Google Reviews plugin for WordPress (all versions up to and including 5.10) contains a stored cross-site scripting (XSS) vulnerability. Authenticated users with Contributor-level access or higher can inject attacker-controlled HTML via shortcode input that is rendered without adequate sanitization, causing injected scripts to execute when other users view affected pages.
CVE Details
- CVE ID: CVE-2026-2388
- Affected component: Reviews and Rating – Google Reviews plugin (wp_display() shortcode handler and related shortcodes)
- Affected versions: All versions up to and including 5.10
- Published: August 26, 2026 at 10:16:40 AM UTC
- Last modified: August 26, 2026 at 4:19:05 PM UTC
- CVSS v3.1: Base Score 6.4 – MEDIUM;
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - Attack vector: NETWORK
- Attack complexity: LOW
- Privileges required: LOW (requires an authenticated user with Contributor-level access or above)
- User interaction: NONE
- Scope: CHANGED
- Impact: Confidentiality: LOW; Integrity: LOW; Availability: NONE
- Weakness: CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-site Scripting)
Technical Details
The vulnerability is a stored cross-site scripting issue caused by the plugin’s wp_display() shortcode handler, which is used by multiple shortcodes. The handler permits attacker-controlled html_tags values to define raw HTML tags and then embeds untrusted vicinity content inside those tags without proper sanitization or escaping. Because the plugin stores and later renders this content, an authenticated user with Contributor-level access or higher can inject arbitrary scripts that persist in the site content.
When a page containing the injected content is viewed, the browser will execute the injected scripts in the context of the site, leading to the confidentiality and integrity impacts indicated by the CVSS vector. The description and references point specifically to the wp_display() handler and its handling of html_tags as the root cause.
How This Could Impact Your Website
Consider a small editorial team where the site owner maintains overall access, editors manage published content, internal staff contribute occasional posts, and an external contractor or contributor submits content via the contributor role. If a contributor is able to include crafted input that uses the vulnerable shortcode, that input can be stored and later rendered to other users.
Practical consequences include exposure of internal information displayed on affected pages and an increased risk of targeted phishing or social engineering against staff and contractors if attacker-controlled scripts harvest visible data or session information. Because the vulnerability can execute in the context of site pages, user-visible forms or dashboards that render affected content could be abused to present malicious content to editors or administrators.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributors and other low-privilege accounts with content submission capabilities.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins to reduce attack surface.
- Monitor site activity and logs for unusual behavior, unexpected post edits, or content changes that could indicate injection attempts.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/g-business-reviews-rating/tags/5.10/index.php#L1000
- https://plugins.trac.wordpress.org/browser/g-business-reviews-rating/tags/5.10/index.php#L5750
- https://plugins.trac.wordpress.org/browser/g-business-reviews-rating/tags/5.10/index.php#L5928
- https://plugins.trac.wordpress.org/browser/g-business-reviews-rating/tags/5.10/index.php#L6160
- https://plugins.trac.wordpress.org/browser/g-business-reviews-rating/trunk/index.php#L1000
- https://plugins.trac.wordpress.org/browser/g-business-reviews-rating/trunk/index.php#L5750
- https://plugins.trac.wordpress.org/browser/g-business-reviews-rating/trunk/index.php#L5928
- https://plugins.trac.wordpress.org/browser/g-business-reviews-rating/trunk/index.php#L6160
- https://www.wordfence.com/threat-intel/vulnerabilities/id/082c7f53-ec14-4235-9a09-9cd0a5312ac2?source=cve
