CyberRota Analysis
AI-GeneratedThe Widgets for Google Reviews plugin for WordPress is susceptible to Stored Cross-Site Scripting (XSS) due to inadequate input sanitization and output escaping in its admin settings, affecting all versions up to 13.3. Authenticated attackers with editor-level permissions can exploit this vulnerability to inject malicious scripts, which will execute when users access the compromised pages. Multi-site installations and those with unfiltered_html disabled should prioritize remediation to mitigate potential security risks.
Original NVD Description
The Widgets for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 13.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.