CVE-2026-100148 is a stored cross-site scripting vulnerability in the Rich Showcase for Google Reviews WordPress plugin. The flaw arises from insufficient input sanitization and output escaping of the 'reviews[].text' parameter. An attacker with subscriber-level access or above can inject arbitrary JavaScript code via a malicious Google review. The plugin's default daily cron job auto-imports this malicious review text, causing the payload to execute in the context of any user visiting the affected page on DOMContentLoaded. This vulnerability affects all versions up to and including 7.1.3.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of users visiting the affected pages, potentially leading to session hijacking, defacement, or other client-side attacks. The attack requires authenticated access at subscriber level or higher to inject the payload but does not require a WordPress account to deliver the malicious review. The vulnerability has a CVSS 3.1 base score of 6.4 (medium severity), indicating a moderate impact on confidentiality and integrity without affecting availability.

No official patch or fix is currently confirmed for this vulnerability. Users should check the vendor's advisory for updates. Until a fix is available, restricting subscriber-level access and monitoring for suspicious reviews may reduce risk. Consider disabling the plugin or its auto-import feature if feasible. Avoid relying on generic mitigations as the vulnerability specifically involves input sanitization and output escaping flaws in the plugin.