The Trust Reviews plugin for WordPress suffers from a cross‑site request forgery flaw caused by missing or incorrect nonce validation on the feed_save handler. The vulnerable code allows an attacker to submit a forged request that creates or changes feed entries without authentication. Depending on the site's configuration, this could lead to unauthorized content injection or manipulation of review feeds, degrading the authenticity of user data and potentially harming the site's reputation.

All installations of the Trust Reviews plugin for Google, Tripadvisor, Yelp, Airbnb and other platforms running WordPress version 1.0 or earlier are affected. The issue resides in the plugin’s core code delivered with versions up to and including 1.0.

The CVSS score of 6.1 reflects medium severity and the EPSS score of less than 1% indicates a low probability of exploitation in the wild. The flaw is not listed in the CISA KEV catalog. Exploitation requires no credentials; an attacker can lure a site administrator to click a crafted link or submit a malicious form expression using the forgeable feed_save endpoint. While the low EPSS suggests limited large‑scale abuse, targeted attacks against sites that rely heavily on the plugin’s review feeds are still possible.