CVE-2026-13015: Wp Google Places Review Slider Plugin XSS Vulnerability

Technical summary

CVE-2026-13015 is a reflected XSS flaw in the Wp Google Places Review Slider plugin's admin/partials/googlecrawl_dfs.php file. The vulnerability stems from improper handling of the 'place' GET parameter: the value is URL-decoded and stripslashes() is applied, but it is then directly echoed into an HTML attribute without calling esc_attr(). When the supplied place string is not a key in the wprev_google_crawls WordPress option, the unsanitized value flows directly to output. This allows injection of arbitrary HTML and JavaScript. The vulnerability requires user interaction (clicking a crafted link) but impacts the admin area, escalating its significance. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) reflects network accessibility, low attack complexity, no privileges required, required user interaction, changed scope, and limited confidentiality and integrity impact.

Business impact

Exploitation could allow attackers to compromise administrator accounts or trick privileged users into performing unauthorized actions. Potential consequences include unauthorized modification of site content, injection of malicious code into the website itself (stored XSS via reflected attack chain), defacement, SEO poisoning, or redirection of users to malicious sites. For WordPress site owners relying on this plugin for review management, successful exploitation poses a direct threat to site integrity and user trust.

Affected systems

The Wp Google Places Review Slider plugin versions up to and including 18.1 are vulnerable. This affects WordPress installations where the plugin is active. The vulnerability is present in the admin-facing functionality, meaning it primarily threatens administrators and users with backend access, though the attack vector itself is network-based and requires no authentication from the attacker.

Exploitability

Exploitability is moderate. While the attack requires user interaction (clicking a malicious link), the barrier to exploitation is low: an attacker needs only to craft a URL and socially engineer a site administrator into clicking it. No special tools or deep technical knowledge are required. The plugin's admin interface is a high-value target, making this a practical attack vector. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, but the straightforward nature of reflected XSS means weaponization is trivial.

Remediation

Update the Wp Google Places Review Slider plugin to a patched version released after version 18.1. Verify the update through the official WordPress plugin repository or the vendor's advisory. Site administrators should apply the patch promptly given the admin-area exposure and the ease of exploitation. Until patched, restrict admin access to trusted IP ranges and educate users about phishing attempts with suspicious links.

Patch guidance

Navigate to the WordPress Plugins dashboard, locate Wp Google Places Review Slider, and check for available updates. If an update is available, apply it immediately. If no update is visible, verify the plugin's status in the official WordPress.org plugin repository. In some cases, plugins are removed or deprecated; if the vendor has abandoned the plugin, consider removing it and selecting an alternative review management solution. Always verify patch version numbers against the vendor's official advisory before and after updating.

Detection guidance

Monitor access logs for GET requests to admin/partials/googlecrawl_dfs.php containing unusual 'place' parameter values with special characters, HTML tags, or JavaScript keywords (e.g., 'script', 'onerror', 'onclick'). Look for admin page loads with reflected parameter values in the query string. Web application firewalls can detect payloads containing JavaScript event handlers in URL parameters. Check WordPress admin activity logs for unusual administrator actions or logins following suspicious link clicks. Review server access logs for referrers containing encoded malicious payloads.

Why prioritize this

Despite a MEDIUM CVSS score, this vulnerability warrants prompt attention because it targets the WordPress admin interface where attackers can cause significant harm. Admin-area XSS flaws are generally prioritized higher than public-facing ones due to the sensitivity of admin functions. The low attack complexity and lack of authentication requirements increase practical risk. The plugin's review functionality is often visible site-wide, making the admin compromise a stepping stone to broader site compromise.

Risk score, explained

The CVSS 3.1 score of 6.1 (MEDIUM) reflects the following factors: network-based attack vector (AV:N) with low complexity (AC:L) and no privilege requirements (PR:N) indicate easy exploitation. However, the required user interaction (UI:R) reduces the score. Changed scope (S:C) indicates the vulnerability can affect resources beyond the vulnerable component. Limited confidentiality and integrity impact (C:L/I:L) and no availability impact (A:N) keep it from a higher rating. In context, this reflects a realistic threat profile—a moderately difficult but feasible attack with meaningful consequences for site integrity.

Frequently asked questions