CVE-2026-100148 in Rich Showcase for Google Reviews Plugin
Summary
by MITRE • 10/03/2026
The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'reviews[].text' parameter in all versions up to, and including, 7.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is delivered entirely through a Google review posted for the connected business and requires no WordPress account; the plugin's default daily cron auto-imports the malicious review text, and execution triggers for every visitor on DOMContentLoaded without any further user interaction.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/03/2026
The Rich Showcase for Google Reviews plugin for WordPress presents a significant security risk due to a stored cross-site scripting vulnerability affecting all versions up through 7.1.3. This flaw stems from insufficient input sanitization and output escaping mechanisms within the application code, specifically targeting the reviews[].text parameter used to display customer feedback on websites. The severity of this issue is amplified by its persistence; unlike reflected XSS attacks that require immediate user interaction with a crafted link, stored vulnerabilities reside in the server's database or persistent storage, ensuring that every subsequent visitor to an affected page becomes a potential victim without any direct engagement from the attacker beyond the initial injection phase.
The attack vector for this vulnerability is particularly sophisticated and difficult to detect through traditional means because it leverages legitimate third-party services rather than exploiting WordPress user accounts directly. An authenticated attacker with subscriber-level access or higher can manipulate the plugin's integration with Google Reviews by posting a malicious review containing executable JavaScript code. Because the plugin automatically imports reviews from the connected business profile via a scheduled daily cron job, the payload is seamlessly ingested into the website's database without manual intervention. This automation ensures that once the malicious content is posted to Google, it propagates to all instances of the plugin on affected sites during the next synchronization cycle, effectively turning legitimate customer review sections into vectors for code execution.
Once injected and stored within the system, the malicious script executes automatically in the browsers of any user who visits a page displaying the compromised reviews. The trigger mechanism relies on DOMContentLoaded events, meaning the payload runs as soon as the webpage finishes loading its initial content, requiring no further interaction such as clicking or hovering from the end-user. This automatic execution allows attackers to perform actions on behalf of victims, including stealing session cookies, hijacking administrative accounts if they visit the page, defacing websites by altering DOM elements, or redirecting users to phishing sites designed to harvest credentials. The lack of user interaction required for exploitation significantly lowers the barrier for entry and increases the likelihood of successful compromise across a wide audience.
From a classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. Specifically, it represents Stored XSS where malicious scripts are permanently stored on target servers. In terms of the MITRE ATT&CK framework for enterprise security, this behavior maps to T1059 Command and Control scripting using JavaScript within web applications, facilitating unauthorized access and potential data exfiltration. The reliance on automated cron jobs also highlights risks associated with T1078 Valid Accounts if an attacker gains initial low-level access that allows them to manipulate external integrations like Google Reviews.
Mitigation strategies must address both the immediate technical flaw and broader security hygiene practices. Administrators should update the Rich Showcase for Google Reviews plugin to version 7.1.4 or later, where these sanitization issues have been resolved. In cases where updating is not immediately feasible, implementing a Web Application Firewall with rules capable of detecting and blocking XSS payloads in review text fields can provide temporary protection. Additionally, organizations should enforce strict Content Security Policy headers that restrict the execution of inline scripts unless explicitly whitelisted, thereby neutralizing many stored XSS attacks even if they are successfully injected into the database. Regular auditing of third-party plugin integrations and monitoring for unusual activity in cron job logs can also help detect such injection attempts early before widespread exploitation occurs.