widgetpack

6 results · Clear filters · Feed

• Medium 6.5
  CVE-2026-110020

  Rich Showcase for Google Reviews <= 7.1.6 - Missing Authorization to Authenticated (Contributor+) Site Secret Disclosure via 'grw_auth_code' Site Secret Disclosure via grw-builder Admin Page

  The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.1.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible…

  widgetpack Rich Showcase for Google Reviews Web / CMS
  Oct 28, 2026
• Medium 6.4
  CVE-2026-100148

  Rich Showcase for Google Reviews <= 7.1.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Google Review Text (imported via Places API)

  The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'reviews[].text' parameter in all versions up to, and including, 7.1.3 due to insufficient input sanitization and output escaping. This makes it pos…

  widgetpack Rich Showcase for Google Reviews Web / CMS
  Oct 3, 2026
• Medium 6.4
  CVE-2026-15739

  Rich Showcase for Google Reviews <= 6.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pagination' Shortcode Attribute

  The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'pagination' Shortcode Attribute in all versions up to, and including, 6.9.9 due to insufficient input sanitization and output escaping. This makes it p…

  widgetpack Rich Showcase for Google Reviews Web / CMS
  Jul 24, 2026
• Medium 6.4
  CVE-2026-12154

  Reviews Widgets for Google, Yelp & TripAdvisor <= 2.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'page_id' Shortcode Attribute

  The Reviews Widgets for Google, Yelp & TripAdvisor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'page_id' shortcode attribute of the [fbrev] shortcode in versions up to and including 2.7.3. This is due to insufficient input saniti…

  widgetpack Reviews Widgets for Google, TripAdvisor, Yelp & Recommendations Web / CMS
  Jul 6, 2026
• Medium 4.3
  CVE-2025-9621

  WidgetPack Comment System <= 1.6.1 - Cross-Site Request Forgery

  The WidgetPack Comment System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6.1. This is due to missing or incorrect nonce validation on the wpcmt_sync action in the wpcmt_request_handler function. Th…

  widgetpack WidgetPack Comment System Web / CMS
  Oct 11, 2025
• Medium 6.4
  CVE-2023-6884

  Plugin for Google Reviews <= 3.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode

  This plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in all versions up to, and including, 3.1 due to insufficient input sanitization and output escaping on the 'place_id' attribute. This makes it possible for auth…

  widgetpack Rich Showcase for Google Reviews Web / CMS
  Feb 5, 2024