CVE-2026-2388: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in designextreme Reviews and Rating – Google Reviews

CVE-2026-2388 is a stored cross-site scripting vulnerability in the Reviews and Rating – Google Reviews WordPress plugin by designextreme. The flaw exists in the wp_display() shortcode handler, which is used by multiple shortcodes and improperly neutralizes input by allowing attacker-controlled html_tags values to define raw HTML tags. This permits authenticated attackers with Contributor-level privileges or higher to inject malicious scripts into pages, which execute when those pages are accessed by other users. The vulnerability affects all versions up to and including 5.10.

An attacker with Contributor-level or higher privileges can inject arbitrary web scripts into pages via the vulnerable shortcode handler. These scripts execute in the context of users who view the injected pages, potentially leading to session hijacking, privilege escalation, or other malicious actions. The vulnerability does not affect availability but impacts confidentiality and integrity of user data.

Patch status is not yet confirmed — no official fix or remediation guidance is currently available from the vendor. Until a patch is released, restrict Contributor-level access to trusted users only and consider disabling or removing the vulnerable plugin to prevent exploitation.