WordPress plugin

Rich Showcase for Google Reviews security & vulnerabilities

Q: Is any Rich Showcase for Google Reviews vulnerability listed in CISA KEV?

No. None of the known Rich Showcase for Google Reviews vulnerabilities is currently listed in the CISA KEV catalog.

widget-google-reviews— active installsLast vulnerability Oct 27, 2026

No known unpatched vulnerabilities in the latest version

All 9 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin

9Known vulnerabilities

Critical0
High3
Medium6
Low0

Vulnerabilities per year

All Rich Showcase for Google Reviews vulnerabilities

Rich Showcase for Google Reviews vulnerabilities
Severity	Vulnerability	CVE	Published
Medium6.5	Missing Authorization to Authenticated (Contributor+) Site Secret Disclosure via 'grw_auth_code' Site Secret Disclosure via grw-builder Admin Page ≤7.1.6Update to 7.1.7	CVE-2026-110020	Oct 27
Medium6.4	Authenticated (Subscriber+) Stored Cross-Site Scripting via Google Review Text (imported via Places API) ≤7.1.3Update to 7.1.4	CVE-2026-100148	Oct 02
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting via 'pagination' Shortcode Attribute ≤6.9.9Update to 6.9.10	CVE-2026-15739	Jul 23
Medium4.4	Authenticated (Editor+) Stored Cross-Site Scripting ≤6.9.4.3Update to 6.9.4.4	CVE-2026-32360	Feb 15
High7.2	Unauthenticated Stored Cross-Site Scripting via Google Review ≤6.8Update to 6.8.1	CVE-2025-12499	Dec 5, 2025
Medium6.4	Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode ≤3.1Update to 3.2	CVE-2023-6884	Jan 12, 2024
High8.8	Authenticated (Subscriber+) SQL Injection ≤2.2.3Update to 2.2.4	CVE-2022-44580	Feb 8, 2023
High8.8	Cross-Site Request Forgery ≤2.2.2Update to 2.2.3	—	Nov 16, 2022
Medium5.4	Missing Authorization ≤2.2.2Update to 2.2.3	CVE-2022-45369	Nov 16, 2022

Medium6.5
Missing Authorization to Authenticated (Contributor+) Site Secret Disclosure via 'grw_auth_code' Site Secret Disclosure via grw-builder Admin Page
≤7.1.6Update to 7.1.7
CVE-2026-110020Oct 27
Medium6.4
Authenticated (Subscriber+) Stored Cross-Site Scripting via Google Review Text (imported via Places API)
≤7.1.3Update to 7.1.4
CVE-2026-100148Oct 02
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting via 'pagination' Shortcode Attribute
≤6.9.9Update to 6.9.10
CVE-2026-15739Jul 23
Medium4.4
Authenticated (Editor+) Stored Cross-Site Scripting
≤6.9.4.3Update to 6.9.4.4
CVE-2026-32360Feb 15
High7.2
Unauthenticated Stored Cross-Site Scripting via Google Review
≤6.8Update to 6.8.1
CVE-2025-12499Dec 5, 2025
Medium6.4
Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode
≤3.1Update to 3.2
CVE-2023-6884Jan 12, 2024
High8.8
Authenticated (Subscriber+) SQL Injection
≤2.2.3Update to 2.2.4
CVE-2022-44580Feb 8, 2023
High8.8
Cross-Site Request Forgery
≤2.2.2Update to 2.2.3
e5ca3c84-9d3d-4bbe-90f7-44c9d77a6690Nov 16, 2022
Medium5.4
Missing Authorization
≤2.2.2Update to 2.2.3
CVE-2022-45369Nov 16, 2022

Rich Showcase for Google Reviews: common questions

Does Rich Showcase for Google Reviews have known vulnerabilities?

Yes. VulnCrest Radar lists 9 known vulnerabilities in Rich Showcase for Google Reviews: 3 high, 6 medium. None are known to affect version null.

How do I check which version of Rich Showcase for Google Reviews I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent Rich Showcase for Google Reviews vulnerability?

CVE-2026-110020, published Oct 27, 2026: Rich Showcase for Google Reviews <= 7.1.6 - Missing Authorization to Authenticated (Contributor+) Site Secret Disclosure via 'grw_auth_code' Site Secret Disclosure via grw-builder Admin Page. Severity: Medium (CVSS 6.5).

Is any Rich Showcase for Google Reviews vulnerability listed in CISA KEV?

No. None of the known Rich Showcase for Google Reviews vulnerabilities is currently listed in the CISA KEV catalog.