The Google Places Reviews WordPress plugin before 2.0.0 does not properly escape its Google API key setting, which is reflected on the site's administration panel.
CVSS 3.1MEDIUM 4.8·Network·High privileges·User interaction·EPSS 0.00765·Published 2022-06-13·Fixed in 2.0.0CWE-79