# CVE-2026-125711: Trustindex Review Widget Plugins < 14.3 - Editor+ Stored XSS via Business Name

Status: published. Published: 2026-11-13. Updated: 2026-11-13.

The Widgets for Google Reviews WordPress plugin before 14.3, WP Tripadvisor Review Widgets WordPress plugin before 14.3, Widgets for Booking.com Reviews WordPress plugin before 14.3, Widgets for Reviews & Recommendations WordPress plugin before 14.3, Widgets for Airbnb Reviews WordPress plugin before 14.3, Widgets for Yelp Reviews WordPress plugin before 14.3, Widgets for Amazon Reviews WordPress plugin before 14.3, Widgets for Thumbtack Reviews WordPress plugin before 14.3, Widgets for Ebay Reviews WordPress plugin before 14.3, Widgets for Zillow Reviews WordPress plugin before 14.3, Widgets for Capterra Reviews WordPress plugin before 14.3, Widgets for Expedia Reviews WordPress plugin before 14.3, Widgets for Opentable Reviews WordPress plugin before 14.3, Widgets for WordPress Reviews WordPress plugin before 14.3, Widgets for Hotels.com Reviews WordPress plugin before 14.3, Review Widgets for Szallas.hu WordPress plugin before 14.3, Widgets for AliExpress Reviews WordPress plugin before 14.3, Widgets for Árukereső Reviews WordPress plugin before 14.3, Widgets for Foursquare Reviews WordPress plugin before 14.3, Widgets for Alibaba Reviews WordPress plugin before 14.3, Widgets for SourceForge Reviews WordPress plugin before 14.3 do not sanitise and escape the connected business details before outputting them in their review widgets, which could allow users with the Editor role and above to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in a multisite setup).

## Remediation

No remediation reported in collected sources

## Affected products and versions

- Unknown / Widgets for Google Reviews: ≥ 0; < 14.3 (affected, semver). Source: CNA: WPScan
- Unknown / WP Tripadvisor Review Widgets: ≥ 0; < 14.3 (affected, semver). Source: CNA: WPScan
- Unknown / Widgets for Booking.com Reviews: ≥ 0; < 14.3 (affected, semver). Source: CNA: WPScan
- Unknown / Widgets for Reviews & Recommendations: ≥ 0; < 14.3 (affected, semver). Source: CNA: WPScan
- Unknown / Widgets for Airbnb Reviews: ≥ 0; < 14.3 (affected, semver). Source: CNA: WPScan
- Unknown / Widgets for Yelp Reviews: ≥ 0; < 14.3 (affected, semver). Source: CNA: WPScan
- Unknown / Widgets for Amazon Reviews: ≥ 0; < 14.3 (affected, semver). Source: CNA: WPScan
- Unknown / Widgets for Thumbtack Reviews: ≥ 0; < 14.3 (affected, semver). Source: CNA: WPScan
- Unknown / Widgets for Ebay Reviews: ≥ 0; < 14.3 (affected, semver). Source: CNA: WPScan
- Unknown / Widgets for Zillow Reviews: ≥ 0; < 14.3 (affected, semver). Source: CNA: WPScan
- Unknown / Widgets for Capterra Reviews: ≥ 0; < 14.3 (affected, semver). Source: CNA: WPScan
- Unknown / Widgets for Expedia Reviews: ≥ 0; < 14.3 (affected, semver). Source: CNA: WPScan
- Unknown / Widgets for Opentable Reviews: ≥ 0; < 14.3 (affected, semver). Source: CNA: WPScan
- Unknown / Widgets for WordPress Reviews: ≥ 0; < 14.3 (affected, semver). Source: CNA: WPScan
- Unknown / Widgets for Hotels.com Reviews: ≥ 0; < 14.3 (affected, semver). Source: CNA: WPScan
- Unknown / Review Widgets for Szallas.hu: ≥ 0; < 14.3 (affected, semver). Source: CNA: WPScan
- Unknown / Widgets for AliExpress Reviews: ≥ 0; < 14.3 (affected, semver). Source: CNA: WPScan
- Unknown / Widgets for Árukereső Reviews: ≥ 0; < 14.3 (affected, semver). Source: CNA: WPScan
- Unknown / Widgets for Foursquare Reviews: ≥ 0; < 14.3 (affected, semver). Source: CNA: WPScan
- Unknown / Widgets for Alibaba Reviews: ≥ 0; < 14.3 (affected, semver). Source: CNA: WPScan
- Unknown / Widgets for SourceForge Reviews: ≥ 0; < 14.3 (affected, semver). Source: CNA: WPScan

## Severity and prioritization

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-79

## Exploit evidence

- exploit: https://wpscan.com/vulnerability/87cbeff9-277e-48ea-b61a-53e1e2aaeed2/ (CNA: WPScan)

## References

- https://wpscan.com/vulnerability/87cbeff9-277e-48ea-b61a-53e1e2aaeed2/ (CNA: WPScan; exploit, vdb-entry, technical-description)

## Provenance

- CNA: WPScan: https://www.cve.org/CVERecord?id=CVE-2026-125711; retrieved 2026-11-13; source updated 2026-11-13

Revision: f2bd2894c13d3b301642990b78c9d5fbffea3914aa5bc2c0ac5e6019b5c384b5

Canonical: https://y2.dev/cve/CVE-2026-125711

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.