WP Product Review Lite [wp-product-review] < 3.7.6 (unfixed + closed)
Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability discovered by Sucuri in WordPress WP Product Review Lite plugin (versions <= 3.7.5).
Source: Patchstack
PLUGIN SECURITY
Is Wp Product Review safe?
Embed Google reviews fast and easily into your WordPress site. Increase SEO, trust and sales using Google reviews.
What this plugin does
- Slug:
wp-product-review - Author: Trustindex
- 900000+ active installs
- 98/100 rating (2608 reviews on wordpress.org)
- 18776835 all-time downloads
- On WordPress.org since 2019-11-13
googlegoogle businessgoogle places reviewsreviewswidget
Maintenance status
- Last updated: 2026-06-24 2:17pm GMT
- Tested up to WordPress: 7.0.2
- Requires PHP: 7.4+
Known vulnerabilities
0 known CVEs on file for Wp Product Review. Reported between 2020 and 2020.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| — | WP Product Review Lite [wp-product-review] < 3.7.6 (unfixed + closed) | — | Unknown | < 3.7.6 | 3.7.6 | 2020-05-14 | — |
| — | WP Product Review Lite [wp-product-review] < 3.7.6 | — | Unknown | < 3.7.6 | 3.7.6 | 2020-05-14 | — |
| — | WP Product Review Lite [wp-product-review] < 3.7.6 | — | Unknown | < 3.7.6 | 3.7.6 | — | — |
WP Product Review Lite [wp-product-review] < 3.7.6
The WP Product Review Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.7.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Source: Wordfence
WP Product Review Lite [wp-product-review] < 3.7.6
All user input data is sanitized but the WordPress function used can be bypassed when the parameter is set inside an HTML attribute. A successful attack results in malicious scripts being injected in all the site’s products.
Source: WPScan
How to fix it
Update this plugin to the latest release from wordpress.org — each CVE above lists the exact release that fixed it ("Fixed in") when one is on file.
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- Site Kit by Google – Analytics, Search Console, AdSense, Speed — 5000000+ active installs — 84/100 (1006) — max PHP 8.4
- Google for WooCommerce — 800000+ active installs — 54/100 (266)
- GA Google Analytics – Connect Google Analytics to WordPress — 400000+ active installs — 98/100 (158) — max PHP 8.4
- OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. — 300000+ active installs — 94/100 (211)
- Nextend Social Login and Register — 200000+ active installs — 98/100 (444) — max PHP <8.0
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.