{"id":"CVE-2026-125711","kind":"vulnerability","aliases":["CVE-2026-125711"],"related":[],"title":"WordPress review widget plugins: stored XSS via business details","description":"The Widgets for Google Reviews WordPress plugin before 14.3, WP Tripadvisor Review Widgets WordPress plugin before 14.3, Widgets for Booking.com Reviews WordPress plugin before 14.3, Widgets for Reviews & Recommendations WordPress plugin before 14.3, Widgets for Airbnb Reviews WordPress plugin before 14.3, Widgets for Yelp Reviews WordPress plugin before 14.3, Widgets for Amazon Reviews WordPress plugin before 14.3, Widgets for Thumbtack Reviews WordPress plugin before 14.3, Widgets for Ebay Reviews WordPress plugin before 14.3, Widgets for Zillow Reviews WordPress plugin before 14.3, Widgets for Capterra Reviews WordPress plugin before 14.3, Widgets for Expedia Reviews WordPress plugin before 14.3, Widgets for Opentable Reviews WordPress plugin before 14.3, Widgets for WordPress Reviews WordPress plugin before 14.3, Widgets for Hotels.com Reviews WordPress plugin before 14.3, Review Widgets for Szallas.hu WordPress plugin before 14.3, Widgets for AliExpress Reviews WordPress plugin before 14.3, Widgets for Árukereső Reviews WordPress plugin before 14.3, Widgets for Foursquare Reviews WordPress plugin before 14.3, Widgets for Alibaba Reviews WordPress plugin before 14.3, Widgets for SourceForge Reviews WordPress plugin before 14.3 do not sanitise and escape the connected business details before outputting them in their review widgets, which could allow users with the Editor role and above to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in a multisite setup).","summary":"Several WordPress review-widget plugins before 14.3 output connected business details without sanitising or escaping them. A user with the Editor role or above can store a script that runs in other users' browsers, even where unfiltered HTML is disallowed, such as in multisite.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["multisite","package","wordpress","wordpress-plugins"],"not_affected_if":["no-editor-role-users","plugin-version-14.3-or-later"],"how_to_check":"- Check the installed version of each affected plugin (Widgets for Google Reviews, WP Tripadvisor Review Widgets, Widgets for Booking.com Reviews and the other listed widget plugins) in the WordPress admin Plugins screen.\n- Note any installed version below `14.3`.","fix":"- Update the affected plugins to `14.3` or later.","status":"open","published_at":"2026-11-13T06:16:54+00:00","first_seen_at":"2026-11-13T06:42:17+00:00","triaged_at":"2026-11-13T06:42:22+00:00","updated_at":"2026-11-13T06:42:22+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-13T06:42:22Z","model":"claude-haiku-5-5","output":{"fix":"- Update the affected plugins to `14.3` or later.","reach":"network","title":"WordPress review widget plugins: stored XSS via business details","impact":"medium","summary":"Several WordPress review-widget plugins before 14.3 output connected business details without sanitising or escaping them. A user with the Editor role or above can store a script that runs in other users' browsers, even where unfiltered HTML is disallowed, such as in multisite.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugins","multisite"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker runs scripts in other users' browsers via stored XSS","analyst_note":"","how_to_check":"- Check the installed version of each affected plugin (Widgets for Google Reviews, WP Tripadvisor Review Widgets, Widgets for Booking.com Reviews and the other listed widget plugins) in the WordPress admin Plugins screen.\n- Note any installed version below `14.3`.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-version-14.3-or-later","no-editor-role-users"],"who_is_affected":"Sites running any of the listed review-widget WordPress plugins before 14.3, especially multisite installs where Editors lack unfiltered HTML rights. Users who cannot create or edit content with the Editor role or above are less exposed. unknown for whether default configurations differ.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000793,"input_tokens":5104,"output_tokens":565,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-125711':12A,15A '-2026':11A,14A '14.3':29B,75C,83C,91C,99C,107C,115C,123C,131C,139C,147C,155C,163C,171C,179C,187C,195C,203C,211C,219C,227C,235C 'airbnb':102C 'alibaba':222C 'aliexpress':198C 'allow':254C 'amazon':118C 'attack':269C 'booking.com':86C 'browser':56B 'busi':8A,32B,243C 'capabl':275C 'capterra':150C 'connect':31B,242C 'could':253C 'cross':266C 'cross-sit':265C 'cve':10A,13A 'detail':9A,33B,244C 'disallow':62B,277C 'ebay':134C 'editor':43B,258C 'escap':37B,240C 'even':57B,270C 'exampl':279C 'expedia':158C 'foursquar':214C 'googl':70C 'hotels.com':182C 'html':60B,274C 'multisit':16B,66B,282C 'opent':166C 'output':30B,246C 'packag':17B 'perform':263C 'plugin':4A,21B,27B,73C,81C,89C,97C,105C,113C,121C,129C,137C,145C,153C,161C,169C,177C,185C,193C,201C,209C,217C,225C,233C 'recommend':95C 'review':2A,25B,71C,78C,87C,94C,103C,111C,119C,127C,135C,143C,151C,159C,167C,175C,183C,188C,199C,207C,215C,223C,231C,250C 'review-widget':24B 'role':44B,259C 'run':52B 'sanitis':35B,238C 'script':50B,268C 'setup':283C 'sever':22B 'site':267C 'sourceforg':230C 'store':5A,48B,264C 'szallas.hu':191C 'thumbtack':126C 'tripadvisor':77C 'unfilt':59B,273C 'user':40B,55B,255C 'via':7A 'widget':3A,26B,68C,79C,84C,92C,100C,108C,116C,124C,132C,140C,148C,156C,164C,172C,180C,189C,196C,204C,212C,220C,228C,251C 'without':34B 'wordpress':1A,18B,20B,23B,72C,80C,88C,96C,104C,112C,120C,128C,136C,144C,152C,160C,168C,174C,176C,184C,192C,200C,208C,216C,224C,232C 'wordpress-plugin':19B 'wp':76C 'xss':6A 'yelp':110C 'zillow':142C 'árukereső':206C","nicknames":[],"mitigations":[],"who_affected":"Sites running any of the listed review-widget WordPress plugins before 14.3, especially multisite installs where Editors lack unfiltered HTML rights. Users who cannot create or edit content with the Editor role or above are less exposed. unknown for whether default configurations differ.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","multisite","package","wordpress","wordpressplugins"],"campaign_type":null,"search_a":"'-125711':12A,15A '-2026':11A,14A 'busi':8A 'cve':10A,13A 'detail':9A 'plugin':4A 'review':2A 'store':5A 'via':7A 'widget':3A 'wordpress':1A 'xss':6A","search_b":"'14.3':29B 'browser':56B 'busi':32B 'connect':31B 'detail':33B 'disallow':62B 'editor':43B 'escap':37B 'even':57B 'html':60B 'multisit':16B,66B 'output':30B 'packag':17B 'plugin':21B,27B 'review':25B 'review-widget':24B 'role':44B 'run':52B 'sanitis':35B 'script':50B 'sever':22B 'store':48B 'unfilt':59B 'user':40B,55B 'widget':26B 'without':34B 'wordpress':18B,20B,23B 'wordpress-plugin':19B","search_c":"'14.3':75C,83C,91C,99C,107C,115C,123C,131C,139C,147C,155C,163C,171C,179C,187C,195C,203C,211C,219C,227C,235C 'airbnb':102C 'alibaba':222C 'aliexpress':198C 'allow':254C 'amazon':118C 'attack':269C 'booking.com':86C 'busi':243C 'capabl':275C 'capterra':150C 'connect':242C 'could':253C 'cross':266C 'cross-sit':265C 'detail':244C 'disallow':277C 'ebay':134C 'editor':258C 'escap':240C 'even':270C 'exampl':279C 'expedia':158C 'foursquar':214C 'googl':70C 'hotels.com':182C 'html':274C 'multisit':282C 'opent':166C 'output':246C 'perform':263C 'plugin':73C,81C,89C,97C,105C,113C,121C,129C,137C,145C,153C,161C,169C,177C,185C,193C,201C,209C,217C,225C,233C 'recommend':95C 'review':71C,78C,87C,94C,103C,111C,119C,127C,135C,143C,151C,159C,167C,175C,183C,188C,199C,207C,215C,223C,231C,250C 'role':259C 'sanitis':238C 'script':268C 'setup':283C 'site':267C 'sourceforg':230C 'store':264C 'szallas.hu':191C 'thumbtack':126C 'tripadvisor':77C 'unfilt':273C 'user':255C 'widget':68C,79C,84C,92C,100C,108C,116C,124C,132C,140C,148C,156C,164C,172C,180C,189C,196C,204C,212C,220C,228C,251C 'wordpress':72C,80C,88C,96C,104C,112C,120C,128C,136C,144C,152C,160C,168C,174C,176C,184C,192C,200C,208C,216C,224C,232C 'wp':76C 'yelp':110C 'zillow':142C 'árukereső':206C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T06:16:54+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125711","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125711","severity":null,"published_at":"2026-11-13T06:16:54+00:00","modified_at":"2026-11-13T06:16:54+00:00","first_seen_at":"2026-11-13T06:42:17+00:00","fetched_at":"2026-11-13T06:42:17+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}