Executive brief
The Reviews and Rating – Google Reviews plugin for WordPress, used to display customer reviews and ratings on business websites, contains a vulnerability that allows authenticated users with lower-level access to inject malicious scripts into pages. When other users visit these compromised pages, the malicious scripts execute in their browsers, potentially allowing attackers to steal credentials, deface content, or redirect visitors to phishing sites.
Technical details
The vulnerability is a Stored Cross-Site Scripting (XSS) flaw in the wp_display() shortcode handler that processes the html_tags parameter without proper sanitization. Attackers with Contributor-level access or above can craft malicious shortcode attributes that inject arbitrary HTML and JavaScript into page content. Because the payload is stored in the database, it persists and executes for all users who view the affected page, making this a stored XSS rather than a reflected vulnerability. The flaw affects all versions up to and including 5.10; a patch may be available in a newer version.
Affected products
- WP Reviews & Rating Reviews and Rating – Google Reviews up to and including 5.10
Timeline
- 2026-08-26: disclosed