CVE-2026-125711
Trustindex Review Widget Plugins < 14.3 - Editor+ Stored XSS via Business Name
The Widgets for Google Reviews WordPress plugin before 14.3, WP Tripadvisor Review Widgets WordPress plugin before 14.3, Widgets for Booking.com Reviews WordPress plugin before 14.3, Widgets for Reviews & Recommendations WordPress plugin before 14.3, Widgets for Airbnb Reviews WordPress plugin before 14.3, Widgets for Yelp Reviews WordPress plugin before 14.3, Widgets for Amazon Reviews WordPress plugin before 14.3, Widgets for Thumbtack Reviews WordPress plugin before 14.3, Widgets for Ebay Reviews WordPress plugin before 14.3, Widgets for Zillow Reviews WordPress plugin before 14.3, Widgets for Capterra Reviews WordPress plugin before 14.3, Widgets for Expedia Reviews WordPress plugin before 14.3, Widgets for Opentable Reviews WordPress plugin before 14.3, Widgets for WordPress Reviews WordPress plugin before 14.3, Widgets for Hotels.com Reviews WordPress plugin before 14.3, Review Widgets for Szallas.hu WordPress plugin before 14.3, Widgets for AliExpress Reviews WordPress plugin before 14.3, Widgets for Árukereső Reviews WordPress plugin before 14.3, Widgets for Foursquare Reviews WordPress plugin before 14.3, Widgets for Alibaba Reviews WordPress plugin before 14.3, Widgets for SourceForge Reviews WordPress plugin before 14.3 do not sanitise and escape the connected business details before outputting them in their review widgets, which could allow users with the Editor role and above to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in a multisite setup).
Fixes and workarounds
No remediation reported in collected sources.
Missing remediation information is not evidence that no patch exists.
Affected products and versions
| Product | Versions | Authority |
|---|---|---|
| Widgets for Google Reviews Unknown |
≥ 0; < 14.3 (affected, semver)
Other versions: unaffected |
CNA: WPScan |
| WP Tripadvisor Review Widgets Unknown |
≥ 0; < 14.3 (affected, semver)
Other versions: unaffected |
CNA: WPScan |
| Widgets for Booking.com Reviews Unknown |
≥ 0; < 14.3 (affected, semver)
Other versions: unaffected |
CNA: WPScan |
| Widgets for Reviews & Recommendations Unknown |
≥ 0; < 14.3 (affected, semver)
Other versions: unaffected |
CNA: WPScan |
| Widgets for Airbnb Reviews Unknown |
≥ 0; < 14.3 (affected, semver)
Other versions: unaffected |
CNA: WPScan |
| Widgets for Yelp Reviews Unknown |
≥ 0; < 14.3 (affected, semver)
Other versions: unaffected |
CNA: WPScan |
| Widgets for Amazon Reviews Unknown |
≥ 0; < 14.3 (affected, semver)
Other versions: unaffected |
CNA: WPScan |
| Widgets for Thumbtack Reviews Unknown |
≥ 0; < 14.3 (affected, semver)
Other versions: unaffected |
CNA: WPScan |
| Widgets for Ebay Reviews Unknown |
≥ 0; < 14.3 (affected, semver)
Other versions: unaffected |
CNA: WPScan |
| Widgets for Zillow Reviews Unknown |
≥ 0; < 14.3 (affected, semver)
Other versions: unaffected |
CNA: WPScan |
| Widgets for Capterra Reviews Unknown |
≥ 0; < 14.3 (affected, semver)
Other versions: unaffected |
CNA: WPScan |
| Widgets for Expedia Reviews Unknown |
≥ 0; < 14.3 (affected, semver)
Other versions: unaffected |
CNA: WPScan |
| Widgets for Opentable Reviews Unknown |
≥ 0; < 14.3 (affected, semver)
Other versions: unaffected |
CNA: WPScan |
| Widgets for WordPress Reviews Unknown |
≥ 0; < 14.3 (affected, semver)
Other versions: unaffected |
CNA: WPScan |
| Widgets for Hotels.com Reviews Unknown |
≥ 0; < 14.3 (affected, semver)
Other versions: unaffected |
CNA: WPScan |
| Review Widgets for Szallas.hu Unknown |
≥ 0; < 14.3 (affected, semver)
Other versions: unaffected |
CNA: WPScan |
| Widgets for AliExpress Reviews Unknown |
≥ 0; < 14.3 (affected, semver)
Other versions: unaffected |
CNA: WPScan |
| Widgets for Árukereső Reviews Unknown |
≥ 0; < 14.3 (affected, semver)
Other versions: unaffected |
CNA: WPScan |
| Widgets for Foursquare Reviews Unknown |
≥ 0; < 14.3 (affected, semver)
Other versions: unaffected |
CNA: WPScan |
| Widgets for Alibaba Reviews Unknown |
≥ 0; < 14.3 (affected, semver)
Other versions: unaffected |
CNA: WPScan |
| Widgets for SourceForge Reviews Unknown |
≥ 0; < 14.3 (affected, semver)
Other versions: unaffected |
CNA: WPScan |
Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.
CVSS assessments
No CVSS assessment reported. An unscored record is not a low-severity determination.
Exploit evidence
- https://wpscan.com/vulnerability/87cbeff9-277e-48ea-b61a-53e1e2aaeed2/
exploit · CNA: WPScan
References
- https://wpscan.com/vulnerability/87cbeff9-277e-48ea-b61a-53e1e2aaeed2/CNA: WPScan · exploit, vdb-entry, technical-description
For agents and automation
Read public disclosures for free as Markdown or JSON. Compatible browsers also expose native WebMCP tools to search disclosures, read this page, and discover API access.
Use the ontology-linked Cyber API with x402 pay per request, or a Y2 Pro or Elite API key with the intel:cyber scope.
Endpoints and access details
https://api.y2.dev/api/v2/cyber/cveshttps://api.y2.dev/api/v2/cyber/cves/{cveId}
A workspace owner or admin can create a Pro or Elite API key. Send Authorization: Bearer <Y2_API_KEY> from your trusted agent runtime.
For x402, omit Authorization and read the HTTP 402 payment challenge before signing a retry. Public browser tools do not make payments.