CVE-2026-125711: Widgets for Google Reviews (WordPress plugin) · Cross-site Scripting
Affects Widgets for Google Reviews (WordPress plugin)Source CVE Database V5
Not known to be exploited : upgrade to 14.3 soon.
Data as of 13 Nov 2026, 06:11 UTC
Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD
Thin evidence
One scorer or none- Patch
- Available – fixed in 14.3
Exploitation evidence
Disclosed: evidence found.
CVE published 13 Nov 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 13 Nov 2026.
What to do
Upgrade Widgets for Google Reviews and WP Tripadvisor Review Widgets and Widgets for Booking.com Reviews and Widgets for Reviews & Recommendations and Widgets for Airbnb Reviews and Widgets for Yelp Reviews and Widgets for Amazon Reviews and Widgets for Thumbtack Reviews and Widgets for Ebay Reviews and Widgets for Zillow Reviews and Widgets for Capterra Reviews and Widgets for Expedia Reviews and Widgets for Opentable Reviews and Widgets for WordPress Reviews and Widgets for Hotels.com Reviews and Review Widgets for Szallas.hu and Widgets for AliExpress Reviews and Widgets for Árukereső Reviews and Widgets for Foursquare Reviews and Widgets for Alibaba Reviews and Widgets for SourceForge Reviews to 14.3.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Widgets for Google Reviews | Affected
| Fixed in
|
| WP Tripadvisor Review Widgets | Affected
| Fixed in
|
| Widgets for Booking.com Reviews | Affected
| Fixed in
|
| Widgets for Reviews & Recommendations | Affected
| Fixed in
|
| Widgets for Airbnb Reviews | Affected
| Fixed in
|
| Widgets for Yelp Reviews | Affected
| Fixed in
|
AI-suggested
Upgrade all affected Widgets for Google Reviews and related review plugins to version 14.3 or later, where the vulnerability has been fixed. No additional mitigations are required once the plugins are updated.
Description
Multiple WordPress plugins related to review widgets, including Widgets for Google Reviews and others, before version 14.3, contain a stored cross-site scripting (XSS) vulnerability. This flaw arises because these plugins do not properly sanitize and escape business details before outputting them in review widgets. The vulnerability allows users with Editor role or higher to perform stored XSS attacks even when the unfiltered_html capability is disabled, such as in multisite setups. The issue is fixed in version 14.3.