PT-2025-49356 · WordPress · Rich Shortcodes For Google Reviews

Kishan Vyas · Published 2025-12-06 · Updated 2025-12-11 · CVE-2025-12499

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Rich Shortcodes for Google Reviews plugin for WordPress versions prior to 6.8

Description The Rich Shortcodes for Google Reviews plugin for WordPress is susceptible to Stored Cross-Site Scripting. This is due to insufficient input sanitization and output escaping of Google Review content. This allows unauthenticated attackers to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the affected page. A partial patch was released in version 6.6.2.

Recommendations Update to a version later than 6.8.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-12499

Affected Products

Rich Shortcodes For Google Reviews

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-12499 · Security Note
• https://twitter.com/CVEnew/status/1997209653680525752 · Twitter Post
• https://twitter.com/cracbot/status/1999071716732178802 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3389203/widget-google-reviews · Note
• https://t.me/cveNotify/145006 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/e2960224-4446-4fc6-8d18-6f9911b4cbad?source=cve · Note
• https://t.me/CVEtracker/39000 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1997268610582978778 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3411521/widget-google-reviews · Note