[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f2JU78u0Egc-P_6OUUxTcrm4hJ_xxSQLcGZpT5AvXQls":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":24,"research_verified":25,"research_rounds_completed":26,"research_plan":27,"research_summary":9,"research_vulnerable_code":9,"research_fix_diff":9,"research_exploit_outline":9,"research_model_used":28,"research_started_at":29,"research_completed_at":30,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":25,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":25,"source_links":31},"CVE-2026-11591","widgets-for-google-reviews-authenticated-editor-stored-cross-site-scripting-via-fomo-title-and-fomo-text-parameters","Widgets for Google Reviews \u003C= 13.3 - Authenticated (Editor+) Stored Cross-Site Scripting via 'fomo-title' and 'fomo-text' Parameters","The Widgets for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 13.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.","wp-reviews-plugin-for-google",null,"\u003C=13.3","13.3.1","medium",4.4,"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:H\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-07-10 16:53:22","2026-07-11 05:35:47",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F4d16e945-1576-4d9b-8e1b-995ec457215b?source=api-prod",1,[22,23],"readme.txt","static\u002Fcss\u002Fadmin-page-settings.css","researched",false,3,"This research plan outlines the technical methodology for analyzing and validating CVE-2026-11591, a Stored Cross-Site Scripting (XSS) vulnerability in the **Widgets for Google Reviews** plugin.\n\n### 1. Vulnerability Summary\nThe vulnerability exists due to the \"Widgets for Google Reviews\" plugin failing to sufficiently sanitize and escape the `fomo-title` and `fomo-text` parameters within its admin settings. These parameters are part of the \"FOMO\" (Fear Of Missing Out) notification feature, which displays small popups to users. Because these values are stored in the database and subsequently rendered into both the admin dashboard and public-facing pages without proper output escaping (e.g., via `esc_html` or `esc_attr`), an authenticated attacker with Editor-level permissions can inject arbitrary JavaScript.\n\n### 2. Attack Vector Analysis\n*   **Vulnerable Endpoint:** The settings update handler, typically accessed via `wp-admin\u002Fadmin-ajax.php` or `wp-admin\u002Foptions.php`.\n*   **Vulnerable Parameters:** `fomo-title` and `fomo-text`.\n*   **Required Authentication:** Editor or higher. \n*   **Contextual Trigger:** The XSS executes when an administrator visits the plugin settings page or when a visitor views a page where the Google Reviews\u002FFOMO widget is active.\n*   **Preconditions:** In standard WordPress environments, Editors have the `unfiltered_html` capability. This vulnerability is specifically relevant in **Multisite** environments (where only Super Admins have `unfiltered_html`) or hardened installations where `DISALLOW_UNFILTERED_HTML` is set to `true`.\n\n### 3. Code Flow (Inferred)\nAs the full PHP source is not provided, the following flow is inferred based on standard Trustindex plugin architecture and the provided CSS (`admin-page-settings.css`):\n\n1.  **Entry Point:** An Editor submits a settings form on the Trustindex configuration page (`#trustindex-plugin-settings-page`).\n2.  **Processing:** The plugin receives the request. A handler (likely in an admin-specific class) uses `update_option()` or a similar function to save the `fomo-title` and `fomo-text` values to the `wp_options` table.\n3.  **Storage:** The values are stored raw or with insufficient sanitization (e.g., only using `sanitize_text_field` which does not strip all HTML tags relevant to attribute-based XSS).\n4.  **Sink (Rendering):** When the widget or settings page is loaded, the plugin retrieves these options using `get_option()`. The values are then echoed directly into the HTML:\n    *   *Admin Side:* Within the settings preview or configuration form.\n    *   *Frontend Side:* Inside the FOMO notification template rendered by the plugin's JavaScript or PHP.\n\n### 4. Nonce Acquisition Strategy\nTo interact with the settings programmatically, a valid WordPress nonce is required to bypass CSRF protections.\n\n1.  **Identify Shortcode:** Based on `readme.txt`, the plugin uses shortcodes. A common shortcode for this plugin is `[trustindex no-registration=google]` (inferred).\n2.  **Setup:** Create a page with the plugin's functionality to ensure scripts are enqueued.\n    *   `wp post create --post_type=page --post_status=publish --post_content='[trustindex no-registration=google]'`\n3.  **Extraction:** Navigate to the page or the plugin settings menu. The plugin localizes its settings via `wp_localize_script`.\n    *   **Variable Name:** Look for a global JS object like `trustindex_settings` or `ti_admin_pages` (inferred).\n    *   **Browser Eval:** `browser_eval(\"window.ti_admin_pages?.nonce\")` or `browser_eval(\"window.trustindex_settings?.ajax_nonce\")`.\n\n### 5. Exploitation Strategy\nThis strategy validates the storage and execution of a benign script.\n\n**Step 1: Save Malicious Settings**\nSubmit a POST request to the AJAX handler (typically `wp-admin\u002Fadmin-ajax.php`).\n\n*   **Tool:** `http_request`\n*   **Method:** `POST`\n*   **Content-Type:** `application\u002Fx-www-form-urlencoded`\n*   **Parameters (Inferred):**\n    *   `action`: `trustindex_save_settings` (inferred)\n    *   `nonce`: `[EXTRACTED_NONCE]`\n    *   `fomo-title`: `\">\u003Cscript>alert('title_xss')\u003C\u002Fscript>`\n    *   `fomo-text`: `\">\u003Cimg src=x onerror=alert('text_xss')>`\n\n**Step 2: Trigger the XSS**\nNavigate to the frontend page containing the widget or the plugin settings page.\n\n*   **Tool:** `browser_navigate`\n*   **Target:** `https:\u002F\u002F[TARGET_URL]\u002Fwp-admin\u002Fadmin.php?page=trustindex-google-reviews` (inferred)\n\n### 6. Test Data Setup\n1.  **Environment:** WordPress Multisite installation (to ensure `unfiltered_html` is restricted).\n2.  **Plugin:** Install \"Widgets for Google Reviews\" version 13.3.\n3.  **User:** Create a user with the 'Editor' role.\n4.  **Configuration:** Enable the \"FOMO\" notification feature within the plugin settings.\n\n### 7. Expected Results\n*   The POST request should return a success status (e.g., `{\"success\": true}`).\n*   When navigating to the target page, the browser should trigger the `alert` boxes, confirming that the `\u003Cscript>` and `\u003Cimg>` tags were rendered into the DOM without escaping.\n\n### 8. Verification Steps\nAfter the HTTP request, verify the database state via WP-CLI:\n```bash\n# Check if the payload is stored in the options table\nwp option get trustindex_google_reviews_settings --format=json | grep \"script\"\n```\n\n### 9. Remediation (Defensive Focus)\nThe vulnerability can be remediated by applying the following security principles:\n\n1.  **Sanitization:** Use `wp_kses()` with a strict whitelist of allowed tags for any field intended to support limited HTML, or `sanitize_text_field()` for plain text fields.\n2.  **Output Escaping:** This is the most critical step. Every instance where these options are displayed must be wrapped in an escaping function:\n    *   Use `esc_html()` if the data is inside a standard HTML tag.\n    *   Use `esc_attr()` if the data is inside an HTML attribute (e.g., `value=\"...\"`).\n    *   Example: `echo '\u003Cdiv class=\"ti-fomo-title\">' . esc_html( $fomo_title ) . '\u003C\u002Fdiv>';`","gemini-3-flash-preview","2026-07-15 08:30:08","2026-07-15 08:31:00",{"type":32,"vulnerable_version":33,"fixed_version":11,"vulnerable_browse":34,"vulnerable_zip":35,"fixed_browse":36,"fixed_zip":37,"all_tags":38},"plugin","13.3","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwp-reviews-plugin-for-google\u002Ftags\u002F13.3","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fwp-reviews-plugin-for-google.13.3.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwp-reviews-plugin-for-google\u002Ftags\u002F13.3.1","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fwp-reviews-plugin-for-google.13.3.1.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwp-reviews-plugin-for-google\u002Ftags"]