Vulnerability in Rich Showcase for Google Reviews — CVE-2026-100148

What to do now

Update Rich Showcase for Google Reviews to 7.1.4 or later.

Affected versions

• Everything up to and including 7.1.3

The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'reviews[].text' parameter in all versions up to, and including, 7.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is delivered entirely through a Google review posted for the connected business and requires no WordPress account; the plugin's default daily cron auto-imports the malicious review text, and execution triggers for every visitor on DOMContentLoaded without any further user interaction.

This description is reproduced verbatim from the public vulnerability record.

• https://www.wordfence.com/threat-intel/vulnerabilities/id/f2f3a5be-0b69-43aa-a56f-d602d5def7dc?source=api-prod

Part of this record comes from Wordfence Intelligence. Original: https://www.wordfence.com/threat-intel/vulnerabilities/id/f2f3a5be-0b69-43aa-a56f-d602d5def7dc
Copyright 2012-2026 Defiant Inc. / Full license text

This page is compiled automatically from public databases. Accuracy is not guaranteed; confirm against the vendor advisory before acting.