CVE-2026-2388

Reviews and Rating – Google Reviews <= 5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes

The Reviews and Rating – Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.10. This is due to the wp_display() shortcode handler, used by multiple shortcodes, allowing attacker-controlled html_tags values to define raw HTML tags and then embedding untrusted vicinity content inside those tags. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

We have discovered 6 live websites that are affected by CVE-2026-2388.

Run a Free Instant Scan



Affected Software

Product  G Business Reviews Rating
Category Wordpress Plugins
Vulnerable Domains6 live websites (0.91% of G Business Reviews Rating install base)
Vulnerable Versions
  • from 0 through 5.10
Vulnerable Versions Count1 versions ( 7.14% of all versions)


Common Weakness Enumeration

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')



Details

  • Published - Aug 26, 2026
  • Updated - Aug 27, 2026

Credits

  • Muhammad Yudha - DJ (finder)

Website Distribution by Country

Number of websites using CVE-2026-2388
United States3 websites


Germany1 websites
France1 websites
Netherlands1 websites

Website Distribution by TLD

Number of websites using CVE-2026-2388
.com5 websites
.de1 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-2388

Top websites that are affected by CVE-2026-2388. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
**************.com Netherlands*,***,***
*********.de Germany**,***,***
*********.com France**,***,***
****************.com United States**,***,***
*****************.com United States**,***,***
*************.com United States**,***,***
See full domain list

FAQ

CVE-2026-2388 is Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in G Business Reviews Rating
A total of 6 websites have been identified as vulnerable to CVE-2026-2388, based on global website indexing conducted by WebTechSurvey.
The G Business Reviews Rating is affected by the CVE-2026-2388 vulnerability.
G Business Reviews Rating versions up to and including 5.10 are vulnerable to CVE-2026-2388.

References