Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-2388— Reviews and Rating – Google Reviews <= 5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes

Quick assessment

Affected
designextreme Reviews and Rating – Google Reviews
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 的“Reviews and Rating – Google Reviews”插件在所有 5.10 及以下版本中存在存储型跨站脚本（Stored Cross-Site Scripting, XSS）漏洞。该漏洞源于 简码处理程序（该处理程序被多个简码使用），允许攻击者控制的 参数定义原始 HTML 标签，并将不受信任的周围内容嵌入这些标签中。这使得具有“贡献者（Contributor）”及以上权限的已认证攻击者能够在页面中注入任意 Web 脚本，当用户访问被植入脚本的页面时，这些脚本便会执行。

CVSS 6.4 · Medium

Affected Version Matrix 1

VendorProduct Version RangeStatus
designextreme Reviews and Rating – Google Reviews ≤ 5.10 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-2388

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Reviews and Rating – Google Reviews <= 5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes
Source: CVE Program / CVE List V5
Vulnerability Description
The Reviews and Rating – Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.10. This is due to the wp_display() shortcode handler, used by multiple shortcodes, allowing attacker-controlled html_tags values to define raw HTML tags and then embedding untrusted vicinity content inside those tags. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
designextreme Reviews and Rating – Google Reviews 0 ~ 5.10 -

II. Public POCs for CVE-2026-2388

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-2388

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-2388 (3)

Vendor Pages for CVE-2026-2388 (2)

Other References for CVE-2026-2388 (1)

Other References for CVE-2026-2388 (2)

IV. Related Vulnerabilities

Same product: Reviews and Rating – Google Reviews
Same vendor: designextreme
Same weakness: CWE-79

V. Comments for CVE-2026-2388

No comments yet

Leave a comment