widgetpack

Products

Product	CVEs	Exploited	Latest
Rich Showcase for Google Reviews	5	–	Oct 28, 2026
Reviews Widgets for Google, TripAdvisor, Yelp & Recommendations	1	–	Jul 6, 2026
Reviews Widgets for Google, Yelp & TripAdvisor	1	–	Dec 9, 2025
WidgetPack Comment System	1	–	Oct 11, 2025

CVE-2026-110020 Medium 6.5 Rich Showcase for Google Reviews <= 7.1.6 - Missing Authorization to Authenticated (Contributor+) Site Secret Disclosure via 'grw_auth_code' Site Secret Disclosure via grw-builder Admin Page 0.4%
CVE-2026-100148 Medium 6.4 Rich Showcase for Google Reviews <= 7.1.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Google Review Text (imported via Places API) 0.3%
CVE-2026-15739 Medium 6.4 Rich Showcase for Google Reviews <= 6.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pagination' Shortcode Attribute 0.4%
CVE-2026-12154 Medium 6.4 Reviews Widgets for Google, Yelp & TripAdvisor <= 2.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'page_id' Shortcode Attribute 0.3%
CVE-2025-12705 High 7.2 Social Reviews & Recommendations <= 2.5 - Unauthenticated Stored Cross-Site Scripting via Social Media Reviews 0.4%
CVE-2025-12499 High 7.2 Rich Shortcodes for Google Reviews <= 6.8 - Unauthenticated Stored Cross-Site Scripting via Google Review 0.4%
CVE-2025-9621 Medium 4.3 WidgetPack Comment System <= 1.6.1 - Cross-Site Request Forgery 0.2%
CVE-2023-6884 Medium 6.4 Plugin for Google Reviews <= 3.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode 0.6%