CVE-2026-11591 describes a stored cross-site scripting vulnerability in the Widgets for Google Reviews WordPress plugin up to version 13.3. Authenticated attackers with editor-level or higher privileges can inject arbitrary web scripts through the plugin's admin settings. These scripts execute in the context of users visiting the affected pages. The vulnerability specifically impacts multisite WordPress installations or those with unfiltered_html disabled, due to improper neutralization of input during web page generation (CWE-79). The CVSS 3.1 base score is 4.4, reflecting a medium severity with network attack vector, high attack complexity, and required privileges.

Successful exploitation allows an attacker with editor-level or higher permissions to inject and execute arbitrary scripts in the context of site visitors, potentially leading to data theft, session hijacking, or other malicious actions. The impact is limited to multisite or restricted unfiltered_html environments and requires authenticated access with elevated privileges. There is no indication of availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict editor-level permissions to trusted users only and consider enabling unfiltered_html if appropriate. Monitor official trustindex advisories for updates and apply patches promptly once released.