CVE-2023-6884

This plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in all versions up to, and including, 3.1 due to insufficient input sanitization and output escaping on the 'place_id' attribute. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

• CWE-79
• CWE-79

• https://advisory.abay.sh/cve-2023-6884Exploit, Third Party Advisory
• https://plugins.svn.wordpress.org/widget-google-reviews/tags/3.1/includes/class-feed-shortcode.phpProduct
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3018964%40widget-google-reviews&new=3018964%40widget-google-reviews&sfp_email=&sfph_mail=Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/a8971d54-b54e-4e62-9db2-fa87d2564599?source=cveThird Party Advisory
• https://advisory.abay.sh/cve-2023-6884Exploit, Third Party Advisory
• https://plugins.svn.wordpress.org/widget-google-reviews/tags/3.1/includes/class-feed-shortcode.phpProduct
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3018964%40widget-google-reviews&new=3018964%40widget-google-reviews&sfp_email=&sfph_mail=Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/a8971d54-b54e-4e62-9db2-fa87d2564599?source=cveThird Party Advisory

Published

Feb 5, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-6878The Slick Social Share Buttons plugin for WordPress is vulne…6.5
• CVE-2023-6879Increasing the resolution of video frames, while performing …9.8
• CVE-2023-6880The Visual Composer Website Builder, Landing Page Builder, C…5.4
• CVE-2023-6881Possible buffer overflow in is_mount_point9.8
• CVE-2023-6882The Simple Membership plugin for WordPress is vulnerable to …6.1
• CVE-2023-6883The Easy Social Feed plugin for WordPress is vulnerable to u…4.3
• CVE-2023-6885A vulnerability was found in Tongda OA 2017 up to 11.10. It …9.8
• CVE-2023-6886A vulnerability was found in xnx3 wangmarket 6.1. It has bee…9.8
• CVE-2023-6887A vulnerability classified as critical has been found in say…9.8
• CVE-2023-6888A vulnerability classified as critical was found in PHZ76 Rt…9.8
• CVE-2023-6889Cross-site Scripting (XSS) - Stored in GitHub repository tho…5.4
• CVE-2023-6890Cross-site Scripting (XSS) - Stored in GitHub repository tho…5.4