CVE-2025-12510

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12510", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-30T14:13:05.206Z", "datePublished": "2025-12-06T03:27:04.068Z", "dateUpdated": "2026-04-08T17:02:25.180Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:02:25.180Z"}, "affected": [{"vendor": "trustindex", "product": "Widgets for Google Reviews", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "13.2.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Widgets for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 13.2.4 due to insufficient input sanitization and output escaping on Google Reviews data imported by the plugin. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute in the admin panel (and potentially on the frontend) whenever a user accesses imported reviews, granted they can add a malicious review to a Google Place that is connected to the vulnerable site."}], "title": "Widgets for Google Reviews <= 13.2.4 - Unauthenticated Stored Cross-Site Scripting via Google Reviews", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7adf3335-ed13-43f4-a5f3-05e89be44d2d?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-reviews-plugin-for-google/tags/13.2.1/trustindex-plugin.class.php#L5932"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-reviews-plugin-for-google/tags/13.2.1/trustindex-plugin.class.php#L5907"}, {"url": "https://plugins.trac.wordpress.org/changeset/3399469/wp-reviews-plugin-for-google/trunk/trustindex-plugin.class.php?old=3398822&old_path=wp-reviews-plugin-for-google%2Ftrunk%2Ftrustindex-plugin.class.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "baseScore": 7.2, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Kishan Vyas"}], "timeline": [{"time": "2025-11-05T18:30:13.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-12-05T15:07:55.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-08T20:49:02.447193Z", "id": "CVE-2025-12510", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-08T20:49:29.619Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12510", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-08T20:49:02.447193Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-08T20:49:21.367Z"}}], "cna": {"title": "Widgets for Google Reviews <= 13.2.4 - Unauthenticated Stored Cross-Site Scripting via Google Reviews", "credits": [{"lang": "en", "type": "finder", "value": "Kishan Vyas"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "trustindex", "product": "Widgets for Google Reviews", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "13.2.4"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-05T18:30:13.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-12-05T15:07:55.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7adf3335-ed13-43f4-a5f3-05e89be44d2d?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-reviews-plugin-for-google/tags/13.2.1/trustindex-plugin.class.php#L5932"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-reviews-plugin-for-google/tags/13.2.1/trustindex-plugin.class.php#L5907"}, {"url": "https://plugins.trac.wordpress.org/changeset/3399469/wp-reviews-plugin-for-google/trunk/trustindex-plugin.class.php?old=3398822&old_path=wp-reviews-plugin-for-google%2Ftrunk%2Ftrustindex-plugin.class.php"}], "descriptions": [{"lang": "en", "value": "The Widgets for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 13.2.4 due to insufficient input sanitization and output escaping on Google Reviews data imported by the plugin. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute in the admin panel (and potentially on the frontend) whenever a user accesses imported reviews, granted they can add a malicious review to a Google Place that is connected to the vulnerable site."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:02:25.180Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12510", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:02:25.180Z", "dateReserved": "2025-10-30T14:13:05.206Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-06T03:27:04.068Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Widgets for Google Reviews", "vendor": "trustindex", "versions": [{"lessThanOrEqual": "13.2.4", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Widgets for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 13.2.4 due to insufficient input sanitization and output escaping on Google Reviews data imported by the plugin. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute in the admin panel (and potentially on the frontend) whenever a user accesses imported reviews, granted they can add a malicious review to a Google Place that is connected to the vulnerable site."}, {"lang": "es", "value": "El plugin Widgets for Google Reviews para WordPress es vulnerable a cross-site scripting almacenado en todas las versiones hasta la 13.2.4, inclusive, debido a una sanitizaci\u00f3n de entrada insuficiente y un escape de salida inadecuado en los datos de Google Reviews importados por el plugin. Esto hace posible que atacantes no autenticados inyecten scripts web arbitrarios que se ejecutar\u00e1n en el panel de administraci\u00f3n (y potencialmente en el frontend) cada vez que un usuario acceda a las rese\u00f1as importadas, siempre que puedan a\u00f1adir una rese\u00f1a maliciosa a un lugar de Google que est\u00e9 conectado al sitio vulnerable."}], "id": "CVE-2025-12510", "lastModified": "2026-10-15T21:10:00.327", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12510", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-08T20:49:02.447193Z", "version": "2.0.3"}}]}, "published": "2025-12-06T04:15:47.183", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-reviews-plugin-for-google/tags/13.2.1/trustindex-plugin.class.php#L5907"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-reviews-plugin-for-google/tags/13.2.1/trustindex-plugin.class.php#L5932"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3399469/wp-reviews-plugin-for-google/trunk/trustindex-plugin.class.php?old=3398822&old_path=wp-reviews-plugin-for-google%2Ftrunk%2Ftrustindex-plugin.class.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7adf3335-ed13-43f4-a5f3-05e89be44d2d?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T17:41:13.124143+00:00", "value": {"mitigation_remediation": ["Upgrade the Widgets for Google Reviews plugin to a version newer than 13.2.4, which removes the stored XSS vulnerability.", "If an upgrade cannot be performed immediately, consider disabling the plugin or removing the Google Place integration until a patched version is available.", "In the meantime, enforce output escaping on review content by using the WordPress sanitization functions such as wp_kses and ensure that any imported review data is encoded before rendering in both the admin area and public pages."], "summary": {"action": "Patch", "impact": "Stored cross\u2011site scripting in admin and front\u2011end"}, "threat_synthesis": {"affected_systems": "The vulnerability impacts the WordPress plugin Widgets for Google Reviews, any installation of which uses version 13.2.4 or earlier. All affected systems run this plugin on a WordPress site and have the plugin configured to import reviews from Google Places.", "description_and_impact": "The Widgets for Google Reviews plugin for WordPress is affected by a stored cross\u2011site scripting flaw caused by insufficient input sanitization and output escaping of imported Google Reviews data. An unauthenticated attacker who can add a malicious review to a Google Place linked to the vulnerable site can supply arbitrary JavaScript that is later rendered by the plugin in the admin panel and, potentially, on the public front\u2011end whenever a opens the imported review. The injected script runs with the privileges of the page context, enabling session hijacking, data theft, defacement, or further exploitation of the site.", "risk_and_exploitability": "The CVSS score of 7.2 reflects a high severity, while the EPSS score of less than 1% indicates a low exploitation probability at present. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. An attacker can exploit the weakness without authentication by creating a malicious review on a connected Google Place; the script is stored by the plugin and executed whenever the review is displayed, potentially affecting any visitor or administrator who views the review. Because the remediation is a simple update, the risk decreases once the patch is applied, but until then the ability to run arbitrary client\u2011side code remains."}}}}, "created": "2025-12-08T09:39:44.085123+00:00", "updated": "2026-04-21T17:45:16.488344+00:00", "vendors": ["trustindex", "trustindex$PRODUCT$widgets_for_google_reviews", "wordpress", "wordpress$PRODUCT$wordpress"]}