CVE-2026-2388 in Reviews and Rating Plugin
Summary
by MITRE • 08/26/2026
The Reviews and Rating – Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.10. This is due to the wp_display() shortcode handler, used by multiple shortcodes, allowing attacker-controlled html_tags values to define raw HTML tags and then embedding untrusted vicinity content inside those tags. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
The Reviews and Rating – Google Reviews plugin for WordPress contains a critical security vulnerability affecting all versions up to and including 5.10. This flaw manifests as a Stored Cross-Site Scripting (XSS) issue, which poses a significant risk to the integrity of websites utilizing this specific plugin. The root cause lies within the wp_display shortcode handler, a component responsible for rendering content via shortcodes used by multiple features within the application. Due to insufficient input validation and sanitization mechanisms, the handler permits attacker-controlled html_tags values to define raw HTML tags. Subsequently, untrusted vicinity content is embedded directly inside these tags without proper encoding or filtering, creating an injection vector that allows malicious scripts to be persisted on the server side.
From a technical perspective, this vulnerability exploits the lack of strict type checking and output escaping in the shortcode processing logic. When an authenticated user with Contributor-level access or higher interacts with the plugin's interface, they can supply input values that are interpreted as executable HTML tags rather than plain text data. Because the content is stored within the WordPress database and subsequently rendered on public-facing pages, any visitor who loads a page containing this malicious payload will have their browser execute the injected JavaScript code in the context of the vulnerable website. This persistence distinguishes it from reflected XSS attacks, making it particularly dangerous as the attack does not require social engineering to trick users into clicking specific links; rather, the malware is automatically delivered whenever the compromised content is viewed.
The operational impact of this vulnerability extends beyond simple script execution. Attackers with Contributor-level access can leverage this flaw to steal administrative cookies or session tokens through techniques such as cookie theft via document.cookie exfiltration. This could lead to account takeover if an administrator views a page containing the malicious payload, thereby granting the attacker full control over the WordPress installation. Furthermore, the injected scripts can be used to deface the website by altering its visual presentation, redirect users to phishing sites designed to harvest credentials, or deploy additional malware payloads such as ransomware or cryptominers onto visitor devices. The ability of lower-privileged users like Contributors to execute these actions highlights a severe privilege escalation risk within the application's access control model relative to its security expectations.
In terms of industry standards and threat classification, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. Specifically, it represents Stored XSS where malicious scripts are permanently stored in target servers via forms or other input mechanisms. From a tactical standpoint within the MITRE ATT&CK framework for Enterprise and Mobile, this activity corresponds to T1059 Command and Control scripting using JavaScript, allowing attackers to execute arbitrary commands on victim systems through browser-based execution environments. It also relates to T1274 User Execution if the attack relies on users visiting specific pages, although in stored XSS scenarios, the persistence makes user interaction less of a barrier compared to reflected variants.
To mitigate this vulnerability and secure WordPress installations using affected versions, immediate action is required by site administrators. The primary remediation step is to update the Reviews and Rating – Google Reviews plugin to version 5.11 or later, where the developers have implemented proper input sanitization and output escaping for the wp_display shortcode handler. Until an upgrade can be performed, it is advisable to restrict user roles that possess Contributor-level access or higher if such privileges are not strictly necessary for their operational duties. Implementing a Web Application Firewall (WAF) with rules specifically tuned to detect and block XSS payloads in POST requests containing shortcodes can provide an additional layer of defense by intercepting malicious inputs before they reach the application logic. Regular security audits and code reviews focusing on shortcode handlers should also be conducted to ensure that future updates do not reintroduce similar flaws, ensuring long-term resilience against injection-based attacks.