CVE-2025-66063
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
The WP Google Review Slider plugin for WordPress is missing authorization, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 17.4.
Risk Assessment
An attacker could access functions or data they are not authorized for, potentially leading to content modification or information disclosure.
Recommendation
Update the WP Google Review Slider plugin to the latest version (above 17.4) and verify permission configuration.
Other vulnerabilities in WP Google Review Slider
See all- CVE-2026-66428Medium
The WP Google Review Slider plugin version 18.4 and earlier contains a Cross-Site Request Forgery (CSRF) vulnerability without authentication. An attacker can trick an administrator into performing unwanted actions.
- CVE-2026-66427High
SQL Injection vulnerability in the admin panel of WP Google Review Slider plugin up to version 18.4. Allows an administrator to execute arbitrary SQL queries.
- CVE-2026-39451Medium
The WP Google Review Slider plugin versions up to 18.0 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can exploit this flaw to inject malicious JavaScript code.
Original NVD description (English source)
Missing Authorization vulnerability in jgwhite33 WP Google Review Slider wp-google-places-review-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Google Review Slider: from n/a through <= 17.4.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS