CVE-2026-2388 Overview
CVE-2026-2388 is a stored cross-site scripting (XSS) vulnerability in the Reviews and Rating – Google Reviews plugin for WordPress. The flaw affects all versions up to and including 5.10. The wp_display() shortcode handler accepts attacker-controlled html_tags values that define raw HTML tags, then embeds untrusted content inside those tags. Authenticated users with Contributor-level access or higher can inject arbitrary JavaScript into pages. The injected script executes in the browser of any visitor who loads the affected page, enabling session theft, credential harvesting, and administrative actions on behalf of authenticated viewers.
Critical Impact
Contributor-level attackers can inject persistent JavaScript that executes against every visitor, including administrators, leading to potential account takeover.
Affected Products
- Reviews and Rating – Google Reviews plugin for WordPress (g-business-reviews-rating)
- All versions up to and including 5.10
- WordPress sites permitting Contributor-level or higher registration
Discovery Timeline
- 2026-08-26 - CVE-2026-2388 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-2388
Vulnerability Analysis
The vulnerability is a stored cross-site scripting flaw classified under CWE-79. The plugin exposes multiple shortcodes that share a single rendering routine, wp_display(). That handler reads an html_tags attribute supplied by the shortcode caller and uses the value to construct raw HTML tags surrounding review content. Because the attribute is neither validated against an allow-list nor sanitized before being emitted, an attacker can specify tag names such as script or event-handler-carrying tags. The plugin then wraps untrusted review content between those tags, producing executable markup in the rendered page. Any visitor loading the resulting page executes the injected script in the site origin.
Root Cause
The root cause is missing output encoding and input validation on the html_tags shortcode parameter within wp_display(). The plugin trusts the parameter to be a benign tag name and concatenates it into HTML output without escaping or restricting it to a safe set. See the plugin source at g-business-reviews-rating/tags/5.10/index.php#L1000 and the additional call sites at L5750, L5928, and L6160.
Attack Vector
An attacker authenticates to the target WordPress site with at least Contributor privileges. The attacker creates or edits a post containing one of the vulnerable shortcodes and supplies a crafted html_tags attribute that opens a script tag or an event-handler-bearing tag. When an administrator or other visitor previews or publishes the page, the injected payload runs under the site origin. Consult the Wordfence Vulnerability Report for additional technical context.
Detection Methods for CVE-2026-2388
Indicators of Compromise
- Post or page content containing plugin shortcodes with unusual html_tags attribute values such as script, img, svg, or values containing on-prefixed handlers.
- WordPress wp_posts rows authored by Contributor accounts that include the plugin shortcode alongside encoded JavaScript payloads.
- Outbound browser requests from admin sessions to unfamiliar domains immediately after loading a page rendered by the plugin.
Detection Strategies
- Search the WordPress database for shortcode invocations of the plugin containing an html_tags= attribute with non-alphabetic characters, quotes, or angle brackets.
- Audit Contributor and Author accounts created recently and correlate their post submissions with pages that embed the plugin's shortcodes.
- Deploy web application firewall rules that inspect POST bodies to /wp-admin/post.php for shortcode attributes containing script-like tokens.
Monitoring Recommendations
- Enable WordPress audit logging for post creation, revision, and shortcode usage by non-administrator roles.
- Monitor browser Content Security Policy (CSP) violation reports for inline script executions originating from plugin-rendered pages.
- Alert on anomalous administrative actions performed shortly after an administrator previews content authored by a Contributor.
How to Mitigate CVE-2026-2388
Immediate Actions Required
- Update the Reviews and Rating – Google Reviews plugin to a version later than 5.10 as soon as the vendor publishes a fixed release.
- Restrict Contributor and Author registration on public-facing WordPress sites, and review existing low-privilege accounts for legitimacy.
- Remove or replace instances of the vulnerable shortcodes in published posts until a patched version is installed.
Patch Information
At the time of NVD publication on 2026-08-26, all versions up to and including 5.10 are affected. Monitor the Wordfence Vulnerability Report and the plugin repository for a fixed release, then apply the update site-wide.
Workarounds
- Deactivate the Reviews and Rating – Google Reviews plugin until a patched release is available.
- Enforce a strict Content Security Policy that disallows inline scripts and unknown script sources to blunt payload execution.
- Use a web application firewall to block shortcode attributes containing HTML tag characters submitted by non-administrator roles.
# Configuration example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate g-business-reviews-rating
wp plugin status g-business-reviews-rating
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
