WordPress plugin
Widgets for Google Reviews security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 6 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High1
- Medium5
- Low0
All Widgets for Google Reviews vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium4.4 | Authenticated (Editor+) Stored Cross-Site Scripting via 'fomo-title' and 'fomo-text' Parameters ≤13.3Update to 13.3.1 | CVE-2026-11591 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting via trustindex Shortcode ≤13.2.1Update to 13.2.2 | CVE-2025-9436 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting via Google Reviews ≤13.2.4Update to 13.2.5 | CVE-2025-12510 | |
| Medium6.6 | Multiple Plugins by Trustindex.io <= (Various Versions)- Authenticated (Editor+) Arbitrary File Upload ≤11.0.2Update to 11.1 | CVE-2023-48275 | |
| Medium4.3 | Cross-Site Request Forgery to Plugin Settings Reset ≤10.9Update to 10.9.1 | CVE-2023-3254 | |
| Medium6.4 | Authenticated (Contributor+) Stored XSS ≤9.7.1Update to 9.8 | CVE-2022-4470 |
- Medium4.4Authenticated (Editor+) Stored Cross-Site Scripting via 'fomo-title' and 'fomo-text' Parameters
≤13.3Update to 13.3.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via trustindex Shortcode
≤13.2.1Update to 13.2.2
- High7.2Unauthenticated Stored Cross-Site Scripting via Google Reviews
≤13.2.4Update to 13.2.5
- Medium6.6Multiple Plugins by Trustindex.io <= (Various Versions)- Authenticated (Editor+) Arbitrary File Upload
≤11.0.2Update to 11.1
- Medium4.3Cross-Site Request Forgery to Plugin Settings Reset
≤10.9Update to 10.9.1
- Medium6.4Authenticated (Contributor+) Stored XSS
≤9.7.1Update to 9.8
Widgets for Google Reviews: common questions
Does Widgets for Google Reviews have known vulnerabilities?
Yes. VulnCrest Radar lists 6 known vulnerabilities in Widgets for Google Reviews: 1 high, 5 medium. None are known to affect version null.
How do I check which version of Widgets for Google Reviews I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Widgets for Google Reviews vulnerability?
CVE-2026-11591, published Jul 10, 2026: Widgets for Google Reviews <= 13.3 - Authenticated (Editor+) Stored Cross-Site Scripting via 'fomo-title' and 'fomo-text' Parameters. Severity: Medium (CVSS 4.4).
Is any Widgets for Google Reviews vulnerability listed in CISA KEV?
No. None of the known Widgets for Google Reviews vulnerabilities is currently listed in the CISA KEV catalog.