Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

11 records

Vendor: trustindex Clear all filters
TI-2026-10010 CVE-2026-11591 · GHSA-qc9w-x5m9-8667

Cross-site scripting in trustindex Widgets for Google Reviews

Priority LOW 21

The Widgets for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 13.3 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 4.4 Network High privileges No interaction EPSS 0.00397 Published 2026-07-11 No fix listed CWE-79
TI-2025-13444 CVE-2025-14726 · GHSA-v9g8-4j77-xxgv

Information disclosure in trustindex Widgets for Social Photo Feed

Priority LOW 36

The Widgets for Social Photo Feed plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the '/trustindex_feed_hook_instagram/troubleshooting' and…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.0083 Published 2026-05-02 No fix listed CWE-200
TI-2026-04750 CVE-2026-5425 · GHSA-hvhr-x55p-8qm9

Widgets for Social Photo Feed <= 1.7.9 - Unauthenticated Stored Cross-Site Scripting via feed_data

Priority LOW 37

The Widgets for Social Photo Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'feed_data' parameter keys in all versions up to, and including, 1.7.9 due to insufficient input sanitization an…

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00238 Published 2026-04-04 No fix listed CWE-79
TI-2025-42116 CVE-2025-68595 · GHSA-w77q-cf84-7mcq

WordPress Widgets for Social Photo Feed plugin <= 1.8 - Broken Access Control vulnerability

Priority LOW 30

Missing Authorization vulnerability in Trustindex Widgets for Social Photo Feed social-photo-feed-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Widgets for Social Photo…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0027 Published 2025-12-24 No fix listed CWE-862
TI-2025-08648 CVE-2025-9436 · GHSA-gwp9-mvfw-8j7p

Widgets for Google Reviews <= 13.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via trustindex Shortcode

Priority LOW 28

The Widgets for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `trustindex` shortcode in all versions up to, and including, 13.2.1 due to insufficient input sanitization…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00233 Published 2025-12-11 No fix listed CWE-79
TI-2025-11481 CVE-2025-12510 · GHSA-2c5x-r53j-239w

Widgets for Google Reviews <= 13.2.4 - Unauthenticated Stored Cross-Site Scripting via Google Reviews

Priority LOW 32

The Widgets for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 13.2.4 due to insufficient input sanitization and output escaping on Google Reviews d…

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00425 Published 2025-12-06 No fix listed CWE-79
TI-2025-11118 CVE-2025-12123 · GHSA-6g99-gvmw-2fgr

Customer Reviews Collector for WooCommerce <= 4.6.1 - Reflected Cross-Site Scripting

Priority LOW 27

The Customer Reviews Collector for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'email-text' parameter in all versions up to, and including, 4.6.1 due to insufficient input san…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0022 Published 2025-11-27 No fix listed CWE-79
TI-2025-08153 CVE-2025-8906 · GHSA-g45f-55pg-mjr5

Widgets for Tiktok Feed <= 1.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

Priority LOW 28

The Widgets for Tiktok Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'trustindex-feed' shortcode in all versions up to, and including, 1.7.3 due to insufficient input sanitizatio…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00203 Published 2025-09-26 No fix listed CWE-79
TI-2022-04085 CVE-2022-4470 · GHSA-hxq3-6v3r-c86x

Widgets for Google Reviews < 9.8 - Contributor+ Stored XSS

Priority MEDIUM 62

The Widgets for Google Reviews WordPress plugin before 9.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00507 Published 2023-01-30 Fixed in 9.8