CVE-2025-12510 Overview
CVE-2025-12510 is a Stored Cross-Site Scripting (XSS) vulnerability in the Widgets for Google Reviews plugin for WordPress. The flaw affects all versions up to and including 13.2.4. The plugin fails to properly sanitize input and escape output on Google Reviews data imported from connected Google Place listings. Unauthenticated attackers can inject arbitrary web scripts by submitting a malicious review to a Google Place tied to a vulnerable WordPress site. The injected payload executes in the WordPress administrative panel, and potentially on the public frontend, whenever a user views the imported reviews. The vulnerability is tracked under CWE-79.
Critical Impact
Unauthenticated attackers can persist JavaScript payloads that execute in the WordPress admin context, enabling session theft, administrative account takeover, and arbitrary actions in the dashboard.
Affected Products
- Widgets for Google Reviews plugin for WordPress (wp-reviews-plugin-for-google)
- All versions up to and including 13.2.4
- WordPress sites importing reviews from attacker-influenced Google Place listings
Discovery Timeline
- 2025-12-06 - CVE-2025-12510 published to the National Vulnerability Database
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2025-12510
Vulnerability Analysis
The vulnerability stems from the plugin's trust boundary assumption. The plugin treats Google Reviews data as safe content because it originates from a Google API. However, review text and reviewer metadata are attacker-controlled fields that any Google user can populate. When the plugin ingests this data, it stores it in the WordPress database without sufficient HTML sanitization. When the data is rendered in the admin panel or on the frontend, the plugin fails to apply proper output escaping. This allows raw HTML and JavaScript supplied by an external review author to render as live markup in the WordPress context. The vulnerable logic resides in the trustindex-plugin.class.php file, with the affected code paths around lines 5907 and 5932, per the WordPress plugin source tree.
Root Cause
The root cause is improper neutralization of input during web page generation [CWE-79]. The plugin neither sanitizes review fields on ingestion nor escapes them with functions such as esc_html() or wp_kses() on output. Externally sourced data is rendered as trusted markup.
Attack Vector
An unauthenticated attacker posts a Google review containing a script payload to a Google Place that a vulnerable site has connected to the plugin. The site imports the review, stores the payload, and renders it without escaping. When an administrator views the reviews dashboard, the script executes with the privileges of the logged-in admin session.
No verified proof-of-concept code is published. See the Wordfence vulnerability report for additional technical context.
Detection Methods for CVE-2025-12510
Indicators of Compromise
- Imported review records containing HTML tags such as <script>, <img onerror=...>, <svg onload=...>, or javascript: URIs in reviewer name or review body fields
- Unexpected outbound requests from admin browser sessions to attacker-controlled domains shortly after viewing the reviews dashboard
- Creation of new WordPress administrator accounts or modification of existing user roles without authorized activity
- Unusual modifications to plugin or theme files following admin access to the reviews page
Detection Strategies
- Query the WordPress wp_options and plugin-specific tables for entries containing HTML or script tags within stored Google Reviews data
- Inspect rendered admin pages for the wp-reviews-plugin-for-google plugin and search the DOM for unexpected script elements
- Review web server access logs for requests to the plugin's review-display endpoints followed by outbound callbacks from admin IP addresses
Monitoring Recommendations
- Monitor WordPress audit logs for unexpected administrator account creation, role changes, or plugin installations
- Alert on changes to plugin files and on Content Security Policy violations triggered in the admin panel
- Track plugin version inventories across managed WordPress sites and flag any host still running wp-reviews-plugin-for-google<= 13.2.4
How to Mitigate CVE-2025-12510
Immediate Actions Required
- Update the Widgets for Google Reviews plugin to a version newer than 13.2.4 on every affected WordPress site
- Audit existing imported review records and purge any entries containing HTML or script content
- Rotate WordPress administrator credentials and invalidate active sessions if exploitation is suspected
- Review recent administrator activity for unauthorized changes to users, plugins, themes, or site settings
Patch Information
The plugin vendor addressed the issue in a release subsequent to 13.2.4. The fix is documented in the WordPress plugin changeset 3399469, which adds sanitization and escaping to the affected review-rendering code paths.
Workarounds
- Deactivate the Widgets for Google Reviews plugin until the patched version is installed
- Disable automatic import of Google Reviews and manually vet review content before publishing
- Deploy a web application firewall rule that blocks responses containing script tags in plugin review fields
- Apply a strict Content Security Policy in the WordPress admin panel to restrict inline script execution
# Configuration example: update the plugin via WP-CLI
wp plugin update wp-reviews-plugin-for-google
# Verify installed version is above 13.2.4
wp plugin get wp-reviews-plugin-for-google --field=version
# If a patched release is not yet available, deactivate the plugin
wp plugin deactivate wp-reviews-plugin-for-google
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
