Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

7 records

Vendor: widgetpack Clear all filters
TI-2026-81746 CVE-2026-110020 · GHSA-w2f6-cjfj-3fhf

Missing authorization in Rich Showcase for Google Reviews exposes site secret

Priority LOW 29

The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.1.6 This is due to the plugin not properly verifying that a user is authorized to pe…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00382 Published 2026-10-28 No fix listed CWE-862
TI-2026-67411 CVE-2026-100148 · GHSA-xp9f-p9m6-662q

Cross-site scripting in widgetpack Rich Showcase for Google Reviews

Priority LOW 28

The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'reviews[].text' parameter in all versions up to, and including, 7.1.3 due to insufficient input sanitization…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00289 Published 2026-10-03 No fix listed CWE-79
TI-2026-13242 CVE-2026-15739 · GHSA-28x5-9357-94j7

Cross-site scripting in widgetpack Rich Showcase for Google Reviews

Priority LOW 29

The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'pagination' Shortcode Attribute in all versions up to, and including, 6.9.9 due to insufficient input sanitizati…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00419 Published 2026-07-24 No fix listed CWE-79
TI-2026-10461 CVE-2026-12154 · GHSA-7g4w-hpm5-fjj3

Cross-site scripting in widgetpack Reviews Widgets for Google, TripAdvisor, Yelp &…

Priority LOW 28

The Reviews Widgets for Google, Yelp & TripAdvisor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'page_id' shortcode attribute of the [fbrev] shortcode in versions up to and including 2.7.3.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00331 Published 2026-07-06 No fix listed CWE-79
TI-2025-11648 CVE-2025-12705 · GHSA-cp8c-5fqx-2h88

Social Reviews & Recommendations <= 2.5 - Unauthenticated Stored Cross-Site Scripting via Social Media Reviews

Priority LOW 38

The Social Reviews & Recommendations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in the 'trim_text' function in all versions up to, and including, 2.5 due to insufficient inpu…

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00374 Published 2025-12-09 No fix listed CWE-79
TI-2025-11470 CVE-2025-12499 · GHSA-cjfp-rjvp-xqgj

Rich Shortcodes for Google Reviews <= 6.8 - Unauthenticated Stored Cross-Site Scripting via Google Review

Priority LOW 32

The Rich Shortcodes for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the contents of a Google Review in all versions up to, and including, 6.8 due to insufficient input sanitizatio…

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00411 Published 2025-12-06 No fix listed CWE-79
TI-2025-08814 CVE-2025-9621 · GHSA-4xpg-9rh8-mfrj

WidgetPack Comment System <= 1.6.1 - Cross-Site Request Forgery

Priority LOW 19

The WidgetPack Comment System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6.1.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00162 Published 2025-10-11 No fix listed CWE-352