Widgets for Google Reviews

Widgets for Google Reviews up to 13.2.4 decodes review text and owner replies imported from Google without sanitizing the result, so an unauthenticated attacker who posts a crafted Google review can run script in the widget on the site and in the plugin’s admin screens (CVE-2025-12510). Up to 13.2.1 the trustindex shortcode also outputs its attributes and the rendered widget unescaped, letting contributor-level users store script in posts (CVE-2025-9436).

This vulnerability affects the following application versions:

• Widgets for Google Reviews 10.9.1
• Widgets for Google Reviews 11.9
• Widgets for Google Reviews 12.0
• Widgets for Google Reviews 12.1.2
• Widgets for Google Reviews 12.2
• Widgets for Google Reviews 12.3
• Widgets for Google Reviews 12.4.7
• Widgets for Google Reviews 12.5
• Widgets for Google Reviews 12.6.1
• Widgets for Google Reviews 12.7.6
• Widgets for Google Reviews 12.8
• Widgets for Google Reviews 12.9
• Widgets for Google Reviews 13.0
• Widgets for Google Reviews 13.1

The plugin’s feature request form saves uploaded attachments into the WordPress uploads directory without checking the file type, so a logged-in user with Editor access or higher can upload a PHP file and run code on the server. Widgets for Google Reviews 11.0.2 and older are affected.

This vulnerability affects the following application versions:

• Widgets for Google Reviews 10.9.1