CVE-2026-15739

Name of the Vulnerable Software and Affected Versions Rich Showcase for Google Reviews versions prior to 7.0.0

Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. This is achieved by injecting arbitrary web scripts through the pagination shortcode attribute, which then execute when a user visits the affected page.

Recommendations Update Rich Showcase for Google Reviews to version 7.0.0 or later. As a temporary mitigation, restrict the use of the pagination attribute in shortcodes for users with contributor-level access.