Multiple Plugins by Trustindex.io <= (Various Versions)- Authenticated (Editor+) Arbitrary File Upload
CVE-2023-48275Published · Updated Action summary
Widgets for Google Reviews: Affected: ≤11.0.2Update to 11.1 or newer
Customer Reviews Collector for WooCommerce: Affected: ≤3.9Update to 4.0 or newer
Widgets for Alibaba Reviews: Affected: ≤11.0.2Update to 11.1 or newer
Widgets for Yelp Reviews: Affected: ≤11.0.2Update to 11.1 or newer
Widgets for Árukereső Reviews: Affected: ≤11.0.2Update to 11.1 or newer
Widgets for Thumbtack Reviews: Affected: ≤11.0.2Update to 11.1 or newer
Widgets for Ebay Reviews: Affected: ≤11.0.2Update to 11.1 or newer
Widgets for Zillow Reviews: Affected: ≤11.0.2Update to 11.1 or newer
Widgets for AliExpress Reviews: Affected: ≤11.0.2Update to 11.1 or newer
Widgets for Foursquare Reviews: Affected: ≤11.0.2Update to 11.1 or newer
Widgets for Reviews & Recommendations: Affected: ≤11.0.2Update to 11.1 or newer
Widgets for Capterra Reviews: Affected: ≤11.0.2Update to 11.1 or newer
Widgets for Booking.com Reviews: Affected: ≤11.0.2Update to 11.1 or newer
Widgets for Hotels.com Reviews: Affected: ≤11.0.2Update to 11.1 or newer
Widgets for WordPress Reviews: Affected: ≤11.0.2Update to 11.1 or newer
WP Tripadvisor Review Widgets: Affected: ≤11.0.2Update to 11.1 or newer
Widgets for Opentable Reviews: Affected: ≤11.0.2Update to 11.1 or newer
Widgets for Amazon Reviews: Affected: ≤11.0.2Update to 11.1 or newer
Review Widgets for Szallas.hu: Affected: ≤11.0.2Update to 11.1 or newer
Widgets for Airbnb Reviews: Affected: ≤11.0.2Update to 11.1 or newer
Widgets for SourceForge Reviews: Affected: ≤11.0.2Update to 11.1 or newer
All remediation steps- Severity
- Medium6.6
- CVSS
- 6.6CVSS 3.1 · CNA (Wordfence)
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:HWhat does this vector mean?
AV:NAttack vector- Network
AC:HAttack complexity- High
PR:HPrivileges required- High
UI:NUser interaction- None
S:UScope- Unchanged
C:HConfidentiality- High
I:HIntegrity- High
A:HAvailability- High
- Weakness
- CWE-434 Arbitrary File Upload
- Required access
- Unknown
- Exploit prediction (EPSS)
- No score
- CISA KEV
- Not listed
On this page8
Am I affected?
Widgets for Google Reviews wp-reviews-plugin-for-google
- Affected≤ 11.0.2
- Patched in11.1
Update to 11.1 or newer.
You are affected if you run ≤ 11.0.2. Version 11.1 and later are not affected by this issue.
Customer Reviews Collector for WooCommerce customer-reviews-collector-for-woocommerce
- Affected≤ 3.9
- Patched in4.0
Update to 4.0 or newer.
You are affected if you run ≤ 3.9. Version 4.0 and later are not affected by this issue.
Widgets for Alibaba Reviews widgets-for-alibaba-reviews
- Affected≤ 11.0.2
- Patched in11.1
Update to 11.1 or newer.
You are affected if you run ≤ 11.0.2. Version 11.1 and later are not affected by this issue.
Widgets for Yelp Reviews reviews-widgets-for-yelp
- Affected≤ 11.0.2
- Patched in11.1
Update to 11.1 or newer.
You are affected if you run ≤ 11.0.2. Version 11.1 and later are not affected by this issue.
Widgets for Árukereső Reviews review-widgets-for-arukereso
- Affected≤ 11.0.2
- Patched in11.1
Update to 11.1 or newer.
You are affected if you run ≤ 11.0.2. Version 11.1 and later are not affected by this issue.
Widgets for Thumbtack Reviews widgets-for-thumbtack-reviews
- Affected≤ 11.0.2
- Patched in11.1
Update to 11.1 or newer.
You are affected if you run ≤ 11.0.2. Version 11.1 and later are not affected by this issue.
Widgets for Ebay Reviews widgets-for-ebay-reviews
- Affected≤ 11.0.2
- Patched in11.1
Update to 11.1 or newer.
You are affected if you run ≤ 11.0.2. Version 11.1 and later are not affected by this issue.
Widgets for Zillow Reviews widgets-for-zillow-reviews
- Affected≤ 11.0.2
- Patched in11.1
Update to 11.1 or newer.
You are affected if you run ≤ 11.0.2. Version 11.1 and later are not affected by this issue.
Widgets for AliExpress Reviews widgets-for-aliexpress-reviews
- Affected≤ 11.0.2
- Patched in11.1
Update to 11.1 or newer.
You are affected if you run ≤ 11.0.2. Version 11.1 and later are not affected by this issue.
Widgets for Foursquare Reviews review-widgets-for-foursquare
- Affected≤ 11.0.2
- Patched in11.1
Update to 11.1 or newer.
You are affected if you run ≤ 11.0.2. Version 11.1 and later are not affected by this issue.
Widgets for Reviews & Recommendations free-facebook-reviews-and-recommendations-widgets
- Affected≤ 11.0.2
- Patched in11.1
Update to 11.1 or newer.
You are affected if you run ≤ 11.0.2. Version 11.1 and later are not affected by this issue.
Widgets for Capterra Reviews review-widgets-for-capterra
- Affected≤ 11.0.2
- Patched in11.1
Update to 11.1 or newer.
You are affected if you run ≤ 11.0.2. Version 11.1 and later are not affected by this issue.
Widgets for Booking.com Reviews review-widgets-for-booking-com
- Affected≤ 11.0.2
- Patched in11.1
Update to 11.1 or newer.
You are affected if you run ≤ 11.0.2. Version 11.1 and later are not affected by this issue.
Widgets for Hotels.com Reviews review-widgets-for-hotels-com
- Affected≤ 11.0.2
- Patched in11.1
Update to 11.1 or newer.
You are affected if you run ≤ 11.0.2. Version 11.1 and later are not affected by this issue.
Widgets for WordPress Reviews reviews-widgets
- Affected≤ 11.0.2
- Patched in11.1
Update to 11.1 or newer.
You are affected if you run ≤ 11.0.2. Version 11.1 and later are not affected by this issue.
WP Tripadvisor Review Widgets review-widgets-for-tripadvisor
- Affected≤ 11.0.2
- Patched in11.1
Update to 11.1 or newer.
You are affected if you run ≤ 11.0.2. Version 11.1 and later are not affected by this issue.
Widgets for Opentable Reviews review-widgets-for-opentable
- Affected≤ 11.0.2
- Patched in11.1
Update to 11.1 or newer.
You are affected if you run ≤ 11.0.2. Version 11.1 and later are not affected by this issue.
Widgets for Amazon Reviews review-widgets-for-amazon
- Affected≤ 11.0.2
- Patched in11.1
Update to 11.1 or newer.
You are affected if you run ≤ 11.0.2. Version 11.1 and later are not affected by this issue.
Review Widgets for Szallas.hu review-widgets-for-szallas-hu
- Affected≤ 11.0.2
- Patched in11.1
Update to 11.1 or newer.
You are affected if you run ≤ 11.0.2. Version 11.1 and later are not affected by this issue.
Widgets for Airbnb Reviews review-widgets-for-airbnb
- Affected≤ 11.0.2
- Patched in11.1
Update to 11.1 or newer.
You are affected if you run ≤ 11.0.2. Version 11.1 and later are not affected by this issue.
Widgets for SourceForge Reviews widgets-for-sourceforge-reviews
- Affected≤ 11.0.2
- Patched in11.1
Update to 11.1 or newer.
You are affected if you run ≤ 11.0.2. Version 11.1 and later are not affected by this issue.
- Check your version: in wp-admin go to Plugins → Installed Plugins and read the version under Widgets for Google Reviews.
- No admin access? Run a passive check of your site. It reads public files only.
What to do
- Update to version 11.1, or a newer patched version
- Update to version 4.0, or a newer patched version
- Update to version 11.1, or a newer patched version
- Update to version 11.1, or a newer patched version
- Update to version 11.1, or a newer patched version
- Update to version 11.1, or a newer patched version
- Update to version 11.1, or a newer patched version
- Update to version 11.1, or a newer patched version
- Update to version 11.1, or a newer patched version
- Update to version 11.1, or a newer patched version
- Update to version 11.1, or a newer patched version
- Update to version 11.1, or a newer patched version
- Update to version 11.1, or a newer patched version
- Update to version 11.1, or a newer patched version
- Update to version 11.1, or a newer patched version
- Update to version 11.1, or a newer patched version
- Update to version 11.1, or a newer patched version
- Update to version 11.1, or a newer patched version
- Update to version 11.1, or a newer patched version
- Update to version 11.1, or a newer patched version
- Update to version 11.1, or a newer patched version
- Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
- Watch Widgets for Google Reviews to get an email when the next vulnerability is published.
Advisory
Source description from Wordfence Intelligence, credited to Rafie Muhammad.
Multiple plugins for WordPress by Trustindex.io are vulnerable to arbitrary file uploads due to missing file type validation in the ~/tabs/feature_request.php file in various versions. This makes it possible for authenticated attackers, with editor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. This vulnerability may only be fully exploitable for RCE in unique scenarios where the server is overloaded and the unlink() is not triggered immediately following move_uploaded_file().
Exploits & references
Proof-of-concept & detection
No public proof-of-concept or detection template is known for this vulnerability.
Advisories & patches
- Advisorywordfence.com
Related CVEs
More in Widgets for Google Reviews
All 6| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium4.4 | Authenticated (Editor+) Stored Cross-Site Scripting via 'fomo-title' and 'fomo-text' Parameters ≤13.3Update to 13.3.1 | CVE-2026-11591 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting via trustindex Shortcode ≤13.2.1Update to 13.2.2 | CVE-2025-9436 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting via Google Reviews ≤13.2.4Update to 13.2.5 | CVE-2025-12510 | |
| Medium4.3 | Cross-Site Request Forgery to Plugin Settings Reset ≤10.9Update to 10.9.1 | CVE-2023-3254 | |
| Medium6.4 | Authenticated (Contributor+) Stored XSS ≤9.7.1Update to 9.8 | CVE-2022-4470 |
- Medium4.4Authenticated (Editor+) Stored Cross-Site Scripting via 'fomo-title' and 'fomo-text' Parameters
≤13.3Update to 13.3.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via trustindex Shortcode
≤13.2.1Update to 13.2.2
- High7.2Unauthenticated Stored Cross-Site Scripting via Google Reviews
≤13.2.4Update to 13.2.5
- Medium4.3Cross-Site Request Forgery to Plugin Settings Reset
≤10.9Update to 10.9.1
- Medium6.4Authenticated (Contributor+) Stored XSS
≤9.7.1Update to 9.8
Same weakness (Arbitrary File Upload)
All Arbitrary File Upload| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High7.2 | Unauthenticated Stored Cross-Site Scripting via Comment User-Agent Header | CVE-2026-120688 | |
| Critical9.8 | Unauthenticated Arbitrary File Upload via File Upload via Public Form Submission | CVE-2026-125055 | |
| Critical9.8 | Unauthenticated PHP Object Injection to Remote Code Execution via 'form' Parameter | CVE-2026-119077 | |
| Medium5.3 | Unauthenticated Sensitive Information Exposure in 'search' Parameter | CVE-2026-121518 |
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment User-Agent Header
EZ SQL Reports Shortcode Widget and DB Backup
≤5.25.25Update to 5.26.45
- Critical9.8Unauthenticated Arbitrary File Upload via File Upload via Public Form Submission
Chatterbug Forms – Fast, Flexible WordPress Form Builder
≤1.0.2Update to 1.1
- Critical9.8Unauthenticated PHP Object Injection to Remote Code Execution via 'form' Parameter
ELEX WordPress HelpDesk & Customer Ticketing System
≤3.3.9Update to 3.4.0
- Medium5.3Unauthenticated Sensitive Information Exposure in 'search' Parameter
Customer Reviews for WooCommerce
≤5.127.0Update to 5.128.0
Timeline
CVE published
Severity medium, CVSS 6.6
Record last updated
Sources & licenses
Wordfence record- Vulnerability data
- Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Licensed under the CC BY-SA 4.0.
- CVE® identifiers
- Copyright 1999-2026 The MITRE Corporation. Used under the CVE Program. CVE® is a registered trademark of The MITRE Corporation.
- CVSS / CWE
- National Vulnerability Database (NVD), shown unmodified. This product uses the NVD API but is not endorsed or certified by the NVD.
- VulnCrest content
- Summary, remediation guidance and page layout © VulnCrest. Not sourced from NVD.