Widgets for Google Reviews up to 13.2.4 decodes review text and owner replies imported from Google without sanitizing the result, so an unauthenticated attacker who posts a crafted Google review can run script in the widget on the site and in the plugin’s admin screens (CVE-2025-12510). Up to 13.2.1 the trustindex shortcode also outputs its attributes and the rendered widget unescaped, letting contributor-level users store script in posts (CVE-2025-9436).
This vulnerability affects the following application versions:
- Widgets for Google Reviews 10.9.1
- Widgets for Google Reviews 11.9
- Widgets for Google Reviews 12.0
- Widgets for Google Reviews 12.1.2
- Widgets for Google Reviews 12.2
- Widgets for Google Reviews 12.3
- Widgets for Google Reviews 12.4.7
- Widgets for Google Reviews 12.5
- Widgets for Google Reviews 12.6.1
- Widgets for Google Reviews 12.7.6
- Widgets for Google Reviews 12.8
- Widgets for Google Reviews 12.9
- Widgets for Google Reviews 13.0
- Widgets for Google Reviews 13.1