CVE-2026-12154

Name of the Vulnerable Software and Affected Versions Reviews Widgets for Google, Yelp & TripAdvisor versions prior to 2.7.4

Description Stored Cross-Site Scripting occurs when authenticated attackers with contributor-level access or higher inject arbitrary web scripts into pages. The issue stems from insufficient input sanitization and output escaping in the Feed Shortcode::fbrev() method. Specifically, the page id attribute of the [fbrev] shortcode is passed through Feed Old::get feed() to the View::render() method, where it is echoed directly into the data-id HTML attribute without using esc attr(). Cross-Site Scripting is a technique where malicious scripts are injected into trusted websites.

Recommendations Update Reviews Widgets for Google, Yelp & TripAdvisor to version 2.7.4 or later. As a temporary mitigation, restrict the use of the page id attribute within the [fbrev] shortcode for users with contributor-level access.