CVE-2026-2388

The Reviews and Rating – Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.10. This is due to the wpdisplay shortcode handler, used by multiple shortcodes, allowing attacker-controlled htmltags values to define raw HTML tags a...

CVE-2026-2388 Reviews and Rating – Google Reviews <= 5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes

The Reviews and Rating – Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.10. This is due to the wpdisplay shortcode handler, used by multiple shortcodes, allowing attacker-controlled htmltags values to define raw HTML tags a...

CVE-2026-2388

The Reviews and Rating – Google Reviews WordPress plugin (slug: g-business-reviews-rating) is vulnerable to Stored Cross-Site Scripting in all versions up to and including 5.10 . The root cause lies in the wp_display() shortcode handler, which allows attacker-controlled html_tags values to define...