CVE-2026-15739

Rich Showcase for Google Reviews <= 6.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pagination' Shortcode Attribute

The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'pagination' Shortcode Attribute in all versions up to, and including, 6.9.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

We have discovered 30,034 live websites that are affected by CVE-2026-15739.

Run a Free Instant Scan



Affected Software

Product  Google Reviews Widget
Category Wordpress Plugins
Vulnerable Domains30,034 live websites (100% of Google Reviews Widget install base)
Vulnerable Versions
  • from 0 through 6.9.9
Vulnerable Versions Count133 versions ( 100% of all versions)


Common Weakness Enumeration

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')



Details

  • Published - Jul 24, 2026
  • Updated - Jul 24, 2026

Credits

  • Wordfence PRISM (finder)

Website Distribution by Country

Number of websites using CVE-2026-15739
United States9,427 websites


Germany2,529 websites
GB2,419 websites
France1,952 websites
Netherlands1,583 websites
Spain1,233 websites
Australia1,208 websites
Italy1,134 websites
Canada1,005 websites
India875 websites

Website Distribution by TLD

Number of websites using CVE-2026-15739
.com13,706 websites
.co.uk1,960 websites
.de1,654 websites
.nl1,548 websites
.com.au1,315 websites
.fr1,065 websites
.it848 websites
.ca590 websites
.pl578 websites
.es520 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-15739

Top websites that are affected by CVE-2026-15739. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
********.nl Belgium**,***
*********************.com United States**,***
************.de Germany**,***
***********.it Italy**,***
****.**.il Israel**,***
******.**.il Israel**,***
***********.**.il United States**,***
*************.**.il Israel**,***
**********.**.il Israel**,***
***************.co United States**,***
See full domain list

FAQ

CVE-2026-15739 is Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Google Reviews Widget
A total of 30,034 websites have been identified as vulnerable to CVE-2026-15739, based on global website indexing conducted by WebTechSurvey.
The Google Reviews Widget is affected by the CVE-2026-15739 vulnerability.
Google Reviews Widget versions up to and including 6.9.9 are vulnerable to CVE-2026-15739.

References