CVE-2025-12510 is a stored cross-site scripting vulnerability in the Widgets for Google Reviews WordPress plugin, affecting all versions up to and including 13.2.4. The issue stems from improper neutralization of input during web page generation, specifically insufficient input sanitization and output escaping of imported Google Reviews data. This allows unauthenticated attackers to inject malicious scripts via crafted Google Place reviews, which execute in the admin panel and possibly on the frontend when these reviews are displayed.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of the WordPress admin panel and potentially the frontend. This can lead to limited confidentiality and integrity impacts, such as session hijacking or unauthorized actions within the admin interface. There is no direct impact on availability reported. Exploitation requires the attacker to add a malicious review to a Google Place linked to the vulnerable site.

No official patch or fix is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, administrators should consider restricting or monitoring the Google Places connected to the plugin to prevent malicious reviews or disable the plugin if feasible. Avoid accessing imported reviews from untrusted sources in the admin panel to reduce risk.