CVE-2026-11591: WordPress Google Reviews Plugin XSS Flaw

CVE-2026-11591 Overview

CVE-2026-11591 is a stored Cross-Site Scripting (XSS) vulnerability in the Widgets for Google Reviews plugin for WordPress. The flaw affects all versions up to and including 13.3. Insufficient input sanitization and output escaping in the admin settings allow authenticated users with editor-level permissions or higher to inject arbitrary web scripts. The injected scripts execute whenever a user visits an affected page. The issue is classified under [CWE-79] and only impacts multi-site installations or environments where the unfiltered_html capability has been disabled.

Critical Impact
Authenticated editors can inject persistent JavaScript into WordPress pages, enabling session theft, account takeover of higher-privileged users, and defacement on multi-site installations.

Affected Products

Widgets for Google Reviews plugin for WordPress (wp-reviews-plugin-for-google)
All versions up to and including 13.3
WordPress multi-site installations or sites with unfiltered_html disabled

Discovery Timeline

2026-07-11 - CVE-2026-11591 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-11591

Vulnerability Analysis

The vulnerability resides in the admin settings interface of the Widgets for Google Reviews plugin. Specifically, the free widget configurator (tabs/free-widget-configurator.php) and the core trustindex-plugin.class.php handler fail to sanitize user-supplied input and do not properly escape output when rendering widget configuration data. An authenticated attacker with editor-level access can save malicious payloads through the widget settings. When any user, including administrators, later loads a page that renders the widget, the browser executes the attacker's JavaScript in the site's origin.

The scope of the flaw is limited by WordPress's built-in unfiltered_html capability. On standard single-site installations, editors and administrators normally hold this capability, which permits raw HTML input. On multi-site installations and hardened environments where unfiltered_html is revoked, the plugin is expected to enforce sanitization itself but does not.

Root Cause

The root cause is missing input sanitization and missing output escaping in the plugin's widget configuration code paths. The plugin trusts data submitted through its admin settings and stores it in the WordPress database without applying functions such as wp_kses(), sanitize_text_field(), or esc_attr(). When the widget is rendered on the front end, the stored data is echoed directly into the HTML response, enabling script execution.

Attack Vector

Exploitation requires an authenticated session with editor-level privileges or higher. The attacker navigates to the plugin's widget configuration interface, submits a crafted payload containing JavaScript into a vulnerable field, and saves the settings. The payload persists in the database and executes for every visitor to any page rendering that widget. The high privilege requirement and complexity limit remote mass exploitation, but the scope-changed nature of stored XSS means a compromised editor can escalate to administrator by hijacking an admin session cookie or triggering privileged actions.

Refer to the Wordfence Vulnerability Analysis and the WordPress Plugin Changeset Overview for the specific code locations and fix details.

Detection Methods for CVE-2026-11591

Indicators of Compromise

Unexpected <script> tags, event handlers (onerror, onload), or javascript: URIs stored in wp_options or wp_postmeta rows referencing the TrustIndex or wp-reviews-plugin-for-google keys.
Outbound requests from browsers loading affected pages to unknown domains hosting attacker-controlled JavaScript.
Unexpected administrator account creation or role changes shortly after editors modify widget settings.
Presence of installed plugin versions 13.3 or earlier of wp-reviews-plugin-for-google.

Detection Strategies

Audit the plugin's stored configuration values in the WordPress database for HTML or JavaScript content that should not be present in review widget settings.
Review WordPress audit logs for update_option or widget-save actions performed by editor accounts against TrustIndex plugin keys.
Deploy web application firewall rules that inspect POST requests to wp-admin/admin.php and admin-ajax.php for XSS payloads targeting the plugin's configuration endpoints.
Enable a Content Security Policy (CSP) in report-only mode to surface inline script violations originating from plugin-rendered pages.

Monitoring Recommendations

Monitor plugin installation inventory across managed WordPress sites and flag any host running wp-reviews-plugin-for-google at version 13.3 or below.
Alert on privilege changes, new administrator accounts, and unusual REST API calls following editor logins.
Track outbound HTTP requests from front-end pages to newly seen or low-reputation domains, which often indicate XSS beaconing.

How to Mitigate CVE-2026-11591

Immediate Actions Required

Update the Widgets for Google Reviews plugin to the patched release published after version 13.3 on all WordPress installations.
Review and clean stored widget configuration values in the database to remove any injected HTML or JavaScript.
Rotate credentials and invalidate active sessions for administrator accounts on multi-site installations where the plugin was active.
Restrict editor-level accounts to trusted users and review recent editor activity for unauthorized configuration changes.

Patch Information

The fix is included in the plugin release that follows version 13.3. Refer to the WordPress Plugin Changeset Overview for the exact code changes applied to tabs/free-widget-configurator.php and trustindex-plugin.class.php. Site administrators should apply the update through the WordPress plugin manager or via WP-CLI.

Workarounds

Temporarily deactivate the Widgets for Google Reviews plugin until the update is applied.
Reduce editor-role membership and require multi-factor authentication for all users with editor privileges or higher.
Deploy a Content Security Policy that disallows inline scripts to blunt exploitation of stored XSS payloads.
On multi-site installations, restrict widget configuration access to super administrators only.

bash

# Update the plugin using WP-CLI
wp plugin update wp-reviews-plugin-for-google

# Verify the installed version is above 13.3
wp plugin get wp-reviews-plugin-for-google --field=version

# Temporary workaround: deactivate the plugin network-wide on multi-site
wp plugin deactivate wp-reviews-plugin-for-google --network