{"items":[{"id":"CVE-2026-110020","published":"2026-10-28T06:45:11.326Z","updated":"2026-10-29T01:41:53.443Z","title":"Rich Showcase for Google Reviews <= 7.1.6 - Missing Authorization to Authenticated (Contributor+) Site Secret Disclosure via 'grw_auth_code' Site Secret Disclosure via grw-builder Admin Page","severity":"MEDIUM","score":6.5,"vendor":"widgetpack","product":"Rich Showcase for Google Reviews","kev":false,"epss":0.00382,"kevAdded":null},{"id":"CVE-2026-100148","published":"2026-10-03T05:29:18.617Z","updated":"2026-10-03T15:42:43.676Z","title":"Rich Showcase for Google Reviews <= 7.1.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Google Review Text (imported via Places API)","severity":"MEDIUM","score":6.4,"vendor":"widgetpack","product":"Rich Showcase for Google Reviews","kev":false,"epss":0.00289,"kevAdded":null},{"id":"CVE-2026-15739","published":"2026-07-24T07:53:36.691Z","updated":"2026-07-24T14:24:07.142Z","title":"Rich Showcase for Google Reviews <= 6.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pagination' Shortcode Attribute","severity":"MEDIUM","score":6.4,"vendor":"widgetpack","product":"Rich Showcase for Google Reviews","kev":false,"epss":0.00419,"kevAdded":null},{"id":"CVE-2026-12154","published":"2026-07-06T17:31:48.426Z","updated":"2026-07-07T14:07:04.454Z","title":"Reviews Widgets for Google, Yelp & TripAdvisor <= 2.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'page_id' Shortcode Attribute","severity":"MEDIUM","score":6.4,"vendor":"widgetpack","product":"Reviews Widgets for Google, TripAdvisor, Yelp & Recommendations","kev":false,"epss":0.00331,"kevAdded":null},{"id":"CVE-2025-12705","published":"2025-12-09T13:51:06.539Z","updated":"2026-04-08T16:59:23.060Z","title":"Social Reviews & Recommendations <= 2.5 - Unauthenticated Stored Cross-Site Scripting via Social Media Reviews","severity":"HIGH","score":7.2,"vendor":"widgetpack","product":"Reviews Widgets for Google, Yelp & TripAdvisor","kev":false,"epss":0.00374,"kevAdded":null},{"id":"CVE-2025-12499","published":"2025-12-06T07:29:11.782Z","updated":"2026-04-08T17:29:15.291Z","title":"Rich Shortcodes for Google Reviews <= 6.8 - Unauthenticated Stored Cross-Site Scripting via Google Review","severity":"HIGH","score":7.2,"vendor":"widgetpack","product":"Rich Showcase for Google Reviews","kev":false,"epss":0.00411,"kevAdded":null},{"id":"CVE-2025-9621","published":"2025-10-11T09:28:36.133Z","updated":"2026-04-08T16:32:34.886Z","title":"WidgetPack Comment System <= 1.6.1 - Cross-Site Request Forgery","severity":"MEDIUM","score":4.3,"vendor":"widgetpack","product":"WidgetPack Comment System","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2023-6884","published":"2024-02-05T21:21:56.066Z","updated":"2026-04-08T17:13:55.206Z","title":"Plugin for Google Reviews <= 3.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode","severity":"MEDIUM","score":6.4,"vendor":"widgetpack","product":"Rich Showcase for Google Reviews","kev":false,"epss":0.00609,"kevAdded":null}]}