Executive brief
A vulnerability exists in a popular WordPress plugin used to display customer reviews from platforms like Google and TripAdvisor. An attacker with basic contributor-level access can inject malicious scripts into website pages. These scripts will automatically run in the browser of any visitor who views the affected page, potentially leading to unauthorized actions or data theft.
Technical details
The vulnerability is a Stored Cross-Site Scripting (XSS) flaw located in the Feed_Shortcode::fbrev() method of the Reviews Widgets for Google, Yelp & TripAdvisor plugin. The 'page_id' attribute of the [fbrev] shortcode is processed without sufficient input sanitization or output escaping. Specifically, the raw attribute value is passed through Feed_Old::get_feed() to View::render(), where it is echoed directly into a 'data-id' HTML attribute without using esc_attr(). Authenticated attackers with contributor-level permissions or higher can exploit this to inject malicious JavaScript. The issue is present in versions up to 2.7.3; users should update to the latest patched version.
Affected products
- Trustindex.io (formerly Widgetpack) Reviews Widgets for Google, Yelp & TripAdvisor up to and including 2.7.3
Timeline
- 2026-07-06: disclosed
- 2026-07-06: advisory
References
- https://plugins.trac.wordpress.org/browser/fb-reviews-widget/tags/2.7.3/includes/class-feed-old.php
- https://plugins.trac.wordpress.org/browser/fb-reviews-widget/tags/2.7.3/includes/class-feed-shortcode.php
- https://plugins.trac.wordpress.org/browser/fb-reviews-widget/tags/2.7.3/includes/class-view.php
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3593292%40fb-reviews-widget&old=3451654%40fb-reviews-widget&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/86fbc499-dca3-41da-a6ef-8e97d7e46d0e?source=cve