Rich Showcase for Google Reviews <= 7.1.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Google Review Text (imported via Places API)

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-100148 · Microsoft / collected KEV context

cve-program · CVE-2026-100148

• https://www.wordfence.com/threat-intel/vulnerabilities/id/f2f3a5be-0b69-43aa-a56f-d602d5def7dc?source=cve
• https://plugins.trac.wordpress.org/browser/widget-google-reviews/tags/7.1.2/assets/7.1.2/js/public-main.js#L14
• https://plugins.trac.wordpress.org/browser/widget-google-reviews/tags/7.1.2/includes/class-view.php#L535
• https://plugins.trac.wordpress.org/browser/widget-google-reviews/tags/7.1.2/includes/class-view.php#L453
• https://plugins.trac.wordpress.org/browser/widget-google-reviews/tags/7.1.2/includes/core/class-google-dao.php#L410
• https://plugins.trac.wordpress.org/browser/widget-google-reviews/tags/7.1.2/includes/core/class-google-dao.php#L445
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3719682%40widget-google-reviews&new=3719682%40widget-google-reviews

No related operational record is retained in the current change model.