High · published December 6, 2025
🚨 A sneaky Stored XSS vulnerability is hiding in all versions of the Widgets for Google Reviews plugin for WordPress up to 13.2.4! 😱 Think of this vulnerability like a restaurant allowing diners to leave reviews where anyone can slip a secret ingredient into the dish without checking what’s inside. If the restaurant doesn't sanitize these reviews before serving them to customers, unsuspecting patrons might end up with a spicy surprise! This means an unauthenticated attacker could inject malicious scripts that execute every time an admin—or even a normal user—accesses imported reviews. Imagine an attacker wreaking havoc in the admin panel or on the frontend, potentially compromising user data and site integrity! 😬
Think of this vulnerability like a restaurant allowing diners to leave reviews where anyone can slip a secret ingredient into the dish without checking what’s inside. If the restaurant doesn't sanitize these reviews before serving them to customers, unsuspecting patrons might end up with a spicy surprise! The Widgets for Google Reviews plugin fails to properly sanitize and escape imported Google Reviews data, allowing attackers to inject arbitrary web scripts that execute in the context of the site.
This means an unauthenticated attacker could inject malicious scripts that execute every time an admin—or even a normal user—accesses imported reviews. Imagine an attacker wreaking havoc in the admin panel or on the frontend, potentially compromising user data and site integrity! 😬 To protect your site, update the plugin to version 13.2.5 or later immediately! Additionally, consider implementing strict input validation and output sanitization practices to prevent future exploits. Don’t wait—lock it down now! You’ve got this! With a quick update, you can shore up your defenses and keep your site secure! 🛡️