Skip to content
OpenAdvisories

Vendor

trustindex

9 known vulnerabilities.

Products

Widgets for Google Reviews 4 Widgets for Social Photo Feed 3 Widgets for Tiktok Feed 1 Customer Reviews Collector for WooCommerce 1
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Medium 4.4
    CVE-2026-11591

    Widgets for Google Reviews <= 13.3 - Authenticated (Editor+) Stored Cross-Site Scripting via 'fomo-title' and 'fomo-text' Parameters

    The Widgets for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 13.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated…

    trustindex Widgets for Google Reviews Web / CMS
  • Medium 6.5
    CVE-2025-14726 Scanner template

    Widgets for Social Photo Feed <= 1.8 - Missing Authentication to Unauthenticated Plugin Settings Access/Update via trustindex_feed_hook_instagram REST API endpoints

    The Widgets for Social Photo Feed plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the '/trustindex_feed_hook_instagram/troubleshooting' and '/trustindex_feed_hook_instagram/submit…

    trustindex Widgets for Social Photo Feed Web / CMS
  • Medium 5.3
    CVE-2025-68595

    WordPress Widgets for Social Photo Feed plugin <= 1.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Trustindex Widgets for Social Photo Feed social-photo-feed-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Widgets for Social Photo Feed: from n/a through <= 1.8.

    trustindex Widgets for Social Photo Feed
  • Medium 6.4
    CVE-2025-9436

    Widgets for Google Reviews <= 13.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via trustindex Shortcode

    The Widgets for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `trustindex` shortcode in all versions up to, and including, 13.2.1 due to insufficient input sanitization and output escaping on user supplied a…

    trustindex Widgets for Google Reviews Web / CMS
  • Medium 6.1
    CVE-2025-12123

    Customer Reviews Collector for WooCommerce <= 4.6.1 - Reflected Cross-Site Scripting

    The Customer Reviews Collector for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'email-text' parameter in all versions up to, and including, 4.6.1 due to insufficient input sanitization and output escaping. This mak…

    trustindex Customer Reviews Collector for WooCommerce Web / CMS
  • Medium 6.4
    CVE-2025-8906

    Widgets for Tiktok Feed <= 1.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Widgets for Tiktok Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'trustindex-feed' shortcode in all versions up to, and including, 1.7.3 due to insufficient input sanitization and output escaping on user supplied …

    trustindex Widgets for Tiktok Feed Web / CMS
  • Medium 4.3
    CVE-2023-3254

    Widgets for Google Reviews <= 10.9 - Cross-Site Request Forgery to Plugin Settings Reset

    The Widgets for Google Reviews plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 10.9. This is due to missing or incorrect nonce validation within setup_no_reg_header.php. This makes it possible for unauthentic…

    trustindex Widgets for Google Reviews Web / CMS