Advisories · Technology

widgetpack Rich Showcase for Google Reviews.

Every CVE that names widgetpack Rich Showcase for Google Reviews among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-110020 CVE record

CVSS 6.5 Medium

Rich Showcase for Google Reviews <= 7.1.6 - Missing Authorization to Authenticated (Contributor+) Site Secret Disclosure via 'grw_auth_code' Site Secret Disclosure via grw-builder Admin Page
- widgetpack Rich Showcase for Google Reviews
- Broken access control
Not analysed yet 28 Oct 2026
CVE-2026-100148 CVE record

CVSS 6.4 Medium

Rich Showcase for Google Reviews <= 7.1.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Google Review Text (imported via Places API)
- widgetpack Rich Showcase for Google Reviews
- Cross-site scripting (XSS)
Not analysed yet 3 Oct 2026
CVE-2026-15739 CVE record

CVSS 6.4 Medium

Rich Showcase for Google Reviews <= 6.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pagination' Shortcode Attribute
- widgetpack Rich Showcase for Google Reviews
- Cross-site scripting (XSS)
Not analysed yet 24 Jul 2026
CVE-2025-12499 CVE record

CVSS 7.2 High

Rich Shortcodes for Google Reviews <= 6.8 - Unauthenticated Stored Cross-Site Scripting via Google Review
- widgetpack Rich Showcase for Google Reviews
- Cross-site scripting (XSS)
Not analysed yet 6 Dec 2025
CVE-2023-6884 CVE record

CVSS 6.4 Medium

Plugin for Google Reviews <= 3.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode
- widgetpack Rich Showcase for Google Reviews
- Cross-site scripting (XSS)
Not analysed yet 5 Feb 2024