CVE-2025-12510High· 7.2▾ Twilight

The Widgets for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 13.2.4 due to insufficient input sanitization and output escaping on Google Reviews data imported by t…

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score40/ 100 · Moderate

impact 39.6 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Dec 6, 2025

Updated

Oct 15, 2026

CVSS

7.2

Vendor

—

Product

—

CWE

CWE-79

Depth score

40 · Moderate

EPSS

0.40% · p34

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

EPSS history

Exploit-prediction probability, daily snapshots since Oct 27.

0.4% → 0.4%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 325 days

Dec 6, 2025Published
Disclosed via NVD
Oct 15, 2026Record revised
Last analysed / modified upstream
Oct 27, 2026EPSS first tracked
0.4%

CWE-79 #nvd

Full technical detail▾

Overview

The Widgets for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 13.2.4 due to insufficient input sanitization and output escaping on Google Reviews data imported by the plugin. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute in the admin panel (and potentially on the frontend) whenever a user accesses imported reviews, granted they can add a malicious review to a Google Place that is connected to the vulnerable site.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd

← Back to feed