Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 299,611 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · wp-google-places-review-slider
WP Google Review Slider
11 known vulnerabilities on record. Add your version above to see which ones affect you.
Jul 27, 2026Unauthenticated Cross Site Request Forgery (CSRF) in WP Google Review Slider <= 18.4 versions.CVE-2026-66428 · affects up to 18.4 · reported by PatchstackMedium 4.3
Unauthenticated Cross Site Request Forgery (CSRF) in WP Google Review Slider <= 18.4 versions.
Jul 27, 2026Administrator SQL Injection in WP Google Review Slider <= 18.4 versions.CVE-2026-66427 · affects up to 18.4 · reported by PatchstackHigh 7.6
Administrator SQL Injection in WP Google Review Slider <= 18.4 versions.
Jul 1, 2026Wp Google Places Review Slider: Reflected Cross-Site ScriptingCVE-2026-13015 · affects up to 18.1 · reported by WordfenceMedium 6.1
The Wp Google Places Review Slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'place' parameter in versions up to, and including, 18.1. This is due to insufficient input sanitization and output escaping in admin/partials/googlecrawl_dfs.php, where the $_GET['place'] value is URL-decoded, stripslashes()'d, and echoed directly into an HTML value attribute with no esc_attr() call when the supplied place is not already a stored key in the wprev_google_crawls option. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in WP Google Review Slider <= 18.0 versions.CVE-2026-39451 · affects up to 18.0 · reported by PatchstackMedium 6.3
Unauthenticated Cross Site Scripting (XSS) in WP Google Review Slider <= 18.0 versions.
Jun 4, 2026WordPress Plugin Google Review Slider 6.1 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database qCVE-2019-25745 · reported by VulnCheckHigh 8.8
WordPress Plugin Google Review Slider 6.1 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'tid' parameter. Attackers can send GET requests to the admin interface with malicious 'tid' values to extract sensitive database information using time-based blind SQL injection techniques.
Nov 21, 2025WP Google Review Slider: Missing AuthorizationCVE-2025-66063 · affects up to 17.4 · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in jgwhite33 WP Google Review Slider wp-google-places-review-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Google Review Slider: from n/a through <= 17.4.
May 15, 2025WP Google Review Slider: Does not sanitise and escape some of its settingsCVE-2024-11109 · fixed in 15.6 · reported by WPScanMedium 4.8
The WP Google Review Slider WordPress plugin before 15.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Mar 27, 2025WP Google Review Slider: Cross-Site Request Forgery (CSRF)CVE-2025-30783 · affects up to 16.0 · reported by PatchstackHigh 8.2
Cross-Site Request Forgery (CSRF) vulnerability in jgwhite33 WP Google Review Slider wp-google-places-review-slider allows SQL Injection.This issue affects WP Google Review Slider: from n/a through <= 16.0.
Apr 26, 2024WP Google Review Slider: Does not sanitise and escape some of its settingsCVE-2024-2310 · fixed in 13.6 · reported by WPScanMedium 5.9
The WP Google Review Slider WordPress plugin before 13.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Feb 13, 2023WP Google Review Slider: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-0259 · fixed in 11.8 · reported by WPScanHigh 8.8
The WP Google Review Slider WordPress plugin before 11.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber.
Dec 26, 2022WP Google Review Slider: Does not sanitise and escape some of its settingsCVE-2022-4242 · fixed in 11.6 · reported by WPScanMedium 4.8
The WP Google Review Slider WordPress plugin before 11.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.