CVE-2026-2388: Reviews and Rating – Google Reviews <= 5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes
The Reviews and Rating – Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.10. This is due to the wpdisplay() shortcode handler, used by multiple shortcodes, allowing attacker-controlled htmltags values to define raw HTML tags and then embedding untrusted vicinity content inside those tags. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
An attacker needs an authenticated WordPress account with the Contributor role or higher. They must be able to add content containing one of the affected plugin shortcodes.
What must happen for the injected script to run?
The attacker injects script through an affected shortcode on a page, and the script executes when another user accesses that injected page. The issue is stored XSS, so the payload remains in the saved page content.
Which plugin versions are affected?
All versions of Reviews and Rating – Google Reviews through 5.10, including 5.10, are affected.