CVE-2025-9436: fallo de gravedad media en trustindex Widgets for Google Reviews
Widgets for Google Reviews <= 13.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via trustindex Shortcode
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.4epss 0.2%
The Widgets for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `trustindex` shortcode in all versions up to, and including, 13.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Productos afectados
trustindex · Widgets for Google ReviewsCVEs relacionadas — trustindex Widgets for Google Reviews
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-12510HIGHWidgets for Google Reviews <= 13.2.4 - Unauthenticated Stored Cross-Site Scripting via Google ReviewsEPSS 0.4%CVE-2026-11591MEDIUMWidgets for Google Reviews <= 13.3 - Authenticated (Editor+) Stored Cross-Site Scripting via 'fomo-title' and 'fomo-text' ParametersEPSS 0.4%CVE-2023-3254MEDIUMWidgets for Google Reviews <= 10.9 - Cross-Site Request Forgery to Plugin Settings ResetEPSS 0.2%