CVE detail
CVE-2026-11591
The Widgets for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 13.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 24.9 · diversity 11.5 · KEV 0.0 · OTX 0.0 · PoC 0.0
Why it matters now
Mention timeline
- Total mentions
- 11
- within the 30d window
- Peak daily
- 10
- highest bucket
Evidence
Source links by recency
11 source links · newest first
- Wordfence Intelligence Weekly WordPress Vulnerability Report (July 6, 2026 to July 12, 2026)Wordfence
.26 - 4.1.15 - Missing Authorization to Unauthenticated Payment Bypass via REST API 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-13039 Patch Status Patched Published Jul 9, 2026 Affected Software Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution] Researcher Niv Kochan More Details > Flatsome FundEngine – Donation
vendorwww.wordfence.comJul 16, 2026, 8:29 PM - https://www.wordfence.com/threat-intel/vulnerabilities/id/4d16e945-1576-4d9b-8e1b-995ec457215b?source=cvewww.wordfence.com
No excerpt available.
Patchwww.wordfence.comJul 11, 2026, 7:16 AM - https://plugins.trac.wordpress.org/changeset?reponame=&old=3584904%40wp-reviews-plugin-for-google&new=3584904%40wp-reviews-plugin-for-googleplugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgJul 11, 2026, 7:16 AM - https://plugins.trac.wordpress.org/browser/wp-reviews-plugin-for-google/trunk/trustindex-plugin.class.php#L6551plugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgJul 11, 2026, 7:16 AM - https://plugins.trac.wordpress.org/browser/wp-reviews-plugin-for-google/trunk/trustindex-plugin.class.php#L649plugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgJul 11, 2026, 7:16 AM - https://plugins.trac.wordpress.org/browser/wp-reviews-plugin-for-google/trunk/tabs/free-widget-configurator.php#L406plugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgJul 11, 2026, 7:16 AM - https://plugins.trac.wordpress.org/browser/wp-reviews-plugin-for-google/trunk/tabs/free-widget-configurator.php#L400plugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgJul 11, 2026, 7:16 AM - https://plugins.trac.wordpress.org/browser/wp-reviews-plugin-for-google/tags/13.2.9/trustindex-plugin.class.php#L6551plugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgJul 11, 2026, 7:16 AM - https://plugins.trac.wordpress.org/browser/wp-reviews-plugin-for-google/tags/13.2.9/trustindex-plugin.class.php#L649plugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgJul 11, 2026, 7:16 AM - https://plugins.trac.wordpress.org/browser/wp-reviews-plugin-for-google/tags/13.2.9/tabs/free-widget-configurator.php#L406plugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgJul 11, 2026, 7:16 AM - https://plugins.trac.wordpress.org/browser/wp-reviews-plugin-for-google/tags/13.2.9/tabs/free-widget-configurator.php#L400plugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgJul 11, 2026, 7:16 AM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
0 repository references · best confidence N/A · max 0 stars
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2026-66390CVSS 6.1 · Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Wicket. This issue affects Apache Wicket: from 9.0.0 through 9.23.0,…
- CVE-2026-66396CVSS 9.3 · Critical
SiYuan before v3.7.2 fails to escape the title-img Individual Attribute List value when rendering Gallery and Kanban cover images, allowing stored cross-site scripting via unescap…
- CVE-2026-66395CVSS 9.4 · Critical
SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler that allows attackers to execute arbitrary code by craftin…
- CVE-2026-66394CVSS 9.3 · Critical
SiYuan before v3.7.3 contains stored and reflected cross-site scripting vulnerabilities in SVG sanitization that allows authenticated attackers to execute scripts by bypassing the…
- CVE-2026-66475CVSS 5.9 · Medium
Shop manager Cross Site Scripting (XSS) in Checkout Field Editor for WooCommerce – Checkout Manager <= 3.0.5 versions.
- CVE-2026-66448CVSS 6.5 · Medium
Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.3 versions.