# Reviews Feed <= 2.14.0 - Authenticated (Contributor+) Sensitive Information Exposure via Block Editor Feed Data

- **ID:** WPSEC-2026-0668
- **Plugin:** Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More (`reviews-feed`), https://wordpress.org/plugins/reviews-feed/
- **Affected versions:** from 2.6.3 before 2.15.0
- **Fixed in:** 2.15.0 (Update to 2.15.0 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-08)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/reviews-feed
- **Fix released:** 2026-10-07
- **Published:** 2026-10-08
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0668/

## Description

The Reviews Feed plugin for WordPress is vulnerable to Sensitive Information Exposure in versions 2.6.3 up to, and including, 2.14.0. The feed block passes the complete stored feed records, including each feed's settings and its connected source records, to the block editor, although the block's feed picker uses only each feed's ID and name. This makes it possible for authenticated attackers, with Contributor-level access and above, to view the configuration of every feed and the source records behind them by opening the post editor, including source names, identifiers and stored details, and for connected Facebook pages the stored page access token, which is encrypted with the site's keys when the OpenSSL extension is available.

## References

- https://wpsec.com/vuln/WPSEC-2026-0668/
- https://plugins.svn.wordpress.org/reviews-feed/tags/2.15.0/
- https://wordpress.org/plugins/reviews-feed/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0668/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.