https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 16:08:38 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-333669 EUVD-2026-333669 https://cve.radiocsirt.org/vuln/euvd-2026-333669 https://cve.radiocsirt.org/vuln/fkie_cve-2026-12154 <p>The Reviews Widgets for Google, Yelp &amp; TripAdvisor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the &#39;page_id&#39; shortcode attribute of the [fbrev] shortcode in versions up to and including 2.7.3. This is due to insufficient input sanitization and output escaping in the Feed_Shortcode::fbrev() method, which passes the raw shortcode attribute through Feed_Old::get_feed() into the View::render() method, where it is echoed directly into the data-id HTML attribute without esc_attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.</p> <p>The Reviews Widgets for Google, Yelp &amp; TripAdvisor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the &#39;page_id&#39; shortcode attribute of the [fbrev] shortcode in versions up to and including 2.7.3. This is due to insufficient input sanitization and output escaping in the Feed_Shortcode::fbrev() method, which passes the raw shortcode attribute through Feed_Old::get_feed() into the View::render() method, where it is echoed directly into the data-id HTML attribute without esc_attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-12154 https://cve.radiocsirt.org/vuln/ghsa-7g4w-hpm5-fjj3 <p>The Reviews Widgets for Google, Yelp &amp; TripAdvisor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the &#39;page_id&#39; shortcode attribute of the [fbrev] shortcode in versions up to and including 2.7.3. This is due to insufficient input sanitization and output escaping in the Feed_Shortcode::fbrev() method, which passes the raw shortcode attribute through Feed_Old::get_feed() into the View::render() method, where it is echoed directly into the data-id HTML attribute without esc_attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.</p> <p>The Reviews Widgets for Google, Yelp &amp; TripAdvisor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the &#39;page_id&#39; shortcode attribute of the [fbrev] shortcode in versions up to and including 2.7.3. This is due to insufficient input sanitization and output escaping in the Feed_Shortcode::fbrev() method, which passes the raw shortcode attribute through Feed_Old::get_feed() into the View::render() method, where it is echoed directly into the data-id HTML attribute without esc_attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.</p> https://cve.radiocsirt.org/vuln/ghsa-7g4w-hpm5-fjj3