Junglewise Threat Intelligence

CVE-2026-11591: Trustindex Widgets for Google Reviews Stored XSS in admin settings

CVE-2026-11591 · Severity: medium · CVSS 4.4 · Published 2026-07-11

Executive brief

The Widgets for Google Reviews plugin for WordPress, which is used to display customer reviews on websites, contains a security flaw that allows certain authorized users to inject malicious scripts. An attacker with editor-level permissions could use this to run unauthorized code in the browsers of other site visitors or administrators. This issue primarily affects WordPress multi-site setups or specific configurations where standard security restrictions on HTML content have been relaxed.

Technical details

A Stored Cross-Site Scripting (XSS) vulnerability exists in the Trustindex Widgets for Google Reviews plugin for WordPress due to insufficient input sanitization and output escaping within the admin settings. Authenticated attackers with editor-level permissions or higher can inject arbitrary web scripts into plugin configuration fields. These scripts execute in the context of any user accessing the affected pages. The vulnerability is exploitable in multi-site installations or environments where the 'unfiltered_html' capability is disabled for high-level users. The issue is present in versions up to and including 13.3.

Affected products

  • Trustindex Widgets for Google Reviews up to, and including, 13.3

Timeline

  • 2026-07-11: advisory: NVD publication date
  • 2026-07-11: disclosed: Wordfence disclosure date

References