{
 "id": "WPSEC-2026-2758",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2758/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2758/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2758/index.md",
 "title": "Reviews Widgets for Google, TripAdvisor, Yelp & Recommendations <= 2.9 - Authenticated (Contributor+) Sensitive Information Exposure via Feed Builder Page",
 "description": "The Reviews Widgets for Google, TripAdvisor, Yelp & Recommendations plugin for WordPress is vulnerable to Sensitive Information Exposure via the feed builder page in all versions up to, and including, 2.9. This is due to the builder page being accessible to users with the edit_posts capability while printing the stored feed configuration, including the Facebook page access tokens of connections, and the plugin's stored auth code without restricting them to administrators. This makes it possible for authenticated attackers, with Contributor-level access and above, to retrieve these secrets and potentially use them to access the connected Facebook pages or the plugin's connected service.",
 "plugin": {
  "slug": "fb-reviews-widget",
  "name": "Reviews Widgets for Google, TripAdvisor, Yelp & Recommendations",
  "full_name": "Reviews Widgets for Google, TripAdvisor, Yelp & Recommendations",
  "wordpress_org": "https://wordpress.org/plugins/fb-reviews-widget/",
  "advisories_url": "https://wpsec.com/vuln/plugin/fb-reviews-widget/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/fb-reviews-widget"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "2.0",
    "from_inclusive": true,
    "to": "2.9.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 2.0 before 2.9.1"
  ]
 },
 "introduced_in": "2.0",
 "fixed_in": "2.9.1",
 "remediation": "Update to 2.9.1 or later.",
 "fix_released": "2026-11-08T19:14:20+00:00",
 "published": "2026-11-09T23:44:30+00:00",
 "updated": "2026-11-09T23:33:48.923636+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2758/",
  "https://plugins.svn.wordpress.org/fb-reviews-widget/tags/2.9.1/",
  "https://wordpress.org/plugins/fb-reviews-widget/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/fb-reviews-widget",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-10"
 }
}