Trustindex Review Widget Plugins < 14.3 - Editor+ Stored XSS via Business Name
Summary
| CVE | CVE-2026-125711 |
|---|---|
| State | PUBLISHED |
| Assigner | WPScan |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-11-13 06:16:54 UTC |
| Updated | 2026-11-13 06:16:54 UTC |
| Description | The Widgets for Google Reviews WordPress plugin before 14.3, WP Tripadvisor Review Widgets WordPress plugin before 14.3, Widgets for Booking.com Reviews WordPress plugin before 14.3, Widgets for Reviews & Recommendations WordPress plugin before 14.3, Widgets for Airbnb Reviews WordPress plugin before 14.3, Widgets for Yelp Reviews WordPress plugin before 14.3, Widgets for Amazon Reviews WordPress plugin before 14.3, Widgets for Thumbtack Reviews WordPress plugin before 14.3, Widgets for Ebay Reviews WordPress plugin before 14.3, Widgets for Zillow Reviews WordPress plugin before 14.3, Widgets for Capterra Reviews WordPress plugin before 14.3, Widgets for Expedia Reviews WordPress plugin before 14.3, Widgets for Opentable Reviews WordPress plugin before 14.3, Widgets for WordPress Reviews WordPress plugin before 14.3, Widgets for Hotels.com Reviews WordPress plugin before 14.3, Review Widgets for Szallas.hu WordPress plugin before 14.3, Widgets for AliExpress Reviews WordPress plugin before 14.3, Widgets for Árukereső Reviews WordPress plugin before 14.3, Widgets for Foursquare Reviews WordPress plugin before 14.3, Widgets for Alibaba Reviews WordPress plugin before 14.3, Widgets for SourceForge Reviews WordPress plugin before 14.3 do not sanitise and escape the connected business details before outputting them in their review widgets, which could allow users with the Editor role and above to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in a multisite setup). |
Risk And Classification
Problem Types: CWE-79 Cross-Site Scripting (XSS)
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Unknown | Widgets For Google Reviews | affected 14.3 semver | Not specified |
| CNA | Unknown | WP Tripadvisor Review Widgets | affected 14.3 semver | Not specified |
| CNA | Unknown | Widgets For Booking.com Reviews | affected 14.3 semver | Not specified |
| CNA | Unknown | Widgets For Reviews Recommendations | affected 14.3 semver | Not specified |
| CNA | Unknown | Widgets For Airbnb Reviews | affected 14.3 semver | Not specified |
| CNA | Unknown | Widgets For Yelp Reviews | affected 14.3 semver | Not specified |
| CNA | Unknown | Widgets For Amazon Reviews | affected 14.3 semver | Not specified |
| CNA | Unknown | Widgets For Thumbtack Reviews | affected 14.3 semver | Not specified |
| CNA | Unknown | Widgets For Ebay Reviews | affected 14.3 semver | Not specified |
| CNA | Unknown | Widgets For Zillow Reviews | affected 14.3 semver | Not specified |
| CNA | Unknown | Widgets For Capterra Reviews | affected 14.3 semver | Not specified |
| CNA | Unknown | Widgets For Expedia Reviews | affected 14.3 semver | Not specified |
| CNA | Unknown | Widgets For Opentable Reviews | affected 14.3 semver | Not specified |
| CNA | Unknown | Widgets For WordPress Reviews | affected 14.3 semver | Not specified |
| CNA | Unknown | Widgets For Hotels.com Reviews | affected 14.3 semver | Not specified |
| CNA | Unknown | Review Widgets For Szallas.hu | affected 14.3 semver | Not specified |
| CNA | Unknown | Widgets For AliExpress Reviews | affected 14.3 semver | Not specified |
| CNA | Unknown | Widgets For Rukeres Reviews | affected 14.3 semver | Not specified |
| CNA | Unknown | Widgets For Foursquare Reviews | affected 14.3 semver | Not specified |
| CNA | Unknown | Widgets For Alibaba Reviews | affected 14.3 semver | Not specified |
| CNA | Unknown | Widgets For SourceForge Reviews | affected 14.3 semver | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| wpscan.com/vulnerability/87cbeff9-277e-48ea-b61a-53e1e2aaeed2 | [email protected] | wpscan.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Sanjeev Kumar (en)
CNA: WPScan (en)
There are currently no legacy QID mappings associated with this CVE.