CVE-2026-100148
Received Received - Intake

Stored XSS in Rich Showcase for Google Reviews WordPress Plugin

Publication date: 2026-10-03

Last updated on: 2026-10-03

Assigner: Wordfence

Description
The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'reviews[].text' parameter in all versions up to, and including, 7.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is delivered entirely through a Google review posted for the connected business and requires no WordPress account; the plugin's default daily cron auto-imports the malicious review text, and execution triggers for every visitor on DOMContentLoaded without any further user interaction.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-03
Last Modified
2026-10-03
Generated
2026-10-03
AI Q&A
2026-10-03
EPSS Evaluated
N/A
NVD
CVE-2026-100148
EUVD
EUVD-2026-91913

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
rich_showcase google_reviews to 7.1.3 (inc)
rich_showcase rich_showcase_for_google_reviews to 7.1.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Stored Cross-Site Scripting (XSS) vulnerability in the Rich Showcase for Google Reviews WordPress plugin. It allows authenticated attackers with subscriber-level access or higher to inject malicious scripts via the reviews[].text parameter. The plugin fails to properly sanitize input and escape output, enabling script injection that executes when users visit affected pages.

Detection Guidance

This vulnerability can be detected by checking for the presence of the Rich Showcase for Google Reviews plugin version 7.1.3 or lower. Inspect WordPress installations for the plugin and verify its version. Look for unauthorized script injections in review text fields or pages where reviews are displayed.

Impact Analysis

An attacker could inject scripts that steal user sessions, redirect to malicious sites, or perform actions on behalf of users. Since the payload is delivered through a Google review and auto-imported by the plugin, no WordPress account is needed. The scripts execute automatically for every visitor without further interaction.

Compliance Impact

This vulnerability could lead to data breaches, unauthorized access, or defacement of websites, violating GDPR (data protection) and HIPAA (health data privacy) requirements. Organizations may face fines or penalties for failing to protect user data from such attacks.

Mitigation Strategies

Immediately update the Rich Showcase for Google Reviews plugin to the latest version if available. If no update exists, consider disabling or removing the plugin until a patch is released. Review all imported reviews for suspicious content and remove any unauthorized scripts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100148. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart