CVE-2026-125711: Trustindex Review Widget Plugins < 14.3 - Editor+ Stored XSS via Business Name
The Widgets for Google Reviews WordPress plugin before 14.3, WP Tripadvisor Review Widgets WordPress plugin before 14.3, Widgets for Booking.com Reviews WordPress plugin before 14.3, Widgets for Reviews & Recommendations WordPress plugin before 14.3, Widgets for Airbnb Reviews WordPress plugin before 14.3, Widgets for Yelp Reviews WordPress plugin before 14.3, Widgets for Amazon Reviews WordPress plugin before 14.3, Widgets for Thumbtack Reviews WordPress plugin before 14.3, Widgets for Ebay Reviews WordPress plugin before 14.3, Widgets for Zillow Reviews WordPress plugin before 14.3, Widgets for Capterra Reviews WordPress plugin before 14.3, Widgets for Expedia Reviews WordPress plugin before 14.3, Widgets for Opentable Reviews WordPress plugin before 14.3, Widgets for WordPress Reviews WordPress plugin before 14.3, Widgets for Hotels.com Reviews WordPress plugin before 14.3, Review Widgets for Szallas.hu WordPress plugin before 14.3, Widgets for AliExpress Reviews WordPress plugin before 14.3, Widgets for Árukereső Reviews WordPress plugin before 14.3, Widgets for Foursquare Reviews WordPress plugin before 14.3, Widgets for Alibaba Reviews WordPress plugin before 14.3, Widgets for SourceForge Reviews WordPress plugin before 14.3 do not sanitise and escape the connected business details before outputting them in their review widgets, which could allow users with the Editor role and above to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed (for example in a multisite setup).
Event History
Frequently Asked Questions
What level of access does an attacker need?
The issue is exploitable by a user with Editor-level permissions or higher. It is a stored cross-site scripting issue involving the business name field.
Which installations need to be remediated?
Installations using any of the affected Trustindex review-widget WordPress plugins at a version earlier than 14.3 are affected. Update the installed plugin to version 14.3 or later.
How can I check whether a site is affected?
Review the installed version of the relevant Trustindex review-widget plugin in WordPress. A version below 14.3 should be treated as affected.