Vulnerability · Published Nov 7, 2026 · Assigned by WPScan
CVE-2026-117588WP Google Review Slider < 18.11 - Google API Settings Update via CSRF
Medium 4.3
In plain English
A medium-severity cross-site request forgery in WP Google Review Slider from Unknown. There are no confirmed reports of exploitation so far.
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)–no EPSS score yet
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The WP Google Review Slider WordPress plugin before 18.11 does not perform nonce validation when updating its active Google Places configuration, allowing attackers to alter or destroy that configuration via a forged request, provided they can trick a site administrator into following a crafted link.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | WP Google Review Slider | 0 – before 18.11 |
Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References
- https://wpscan.com/vulnerability/ba4a5e5a-68d2-4f56-bb49-ec03581885a0/ exploit, vdb-entry, technical-description