[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fp4ZAyVQWNYq6fpy38Y4SadiMyUIOinz3_ZH-y1myUMQ":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-13015","wp-google-review-slider-reflected-cross-site-scripting-via-place-parameter","WP Google Review Slider \u003C= 18.1 - Reflected Cross-Site Scripting via 'place' Parameter","The Wp Google Places Review Slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'place' parameter in versions up to, and including, 18.1. This is due to insufficient input sanitization and output escaping in admin\u002Fpartials\u002Fgooglecrawl_dfs.php, where the $_GET['place'] value is URL-decoded, stripslashes()'d, and echoed directly into an HTML value attribute with no esc_attr() call when the supplied place is not already a stored key in the wprev_google_crawls option. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link.","wp-google-places-review-slider",null,"\u003C=18.1","18.2","medium",6.1,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-06-30 15:04:28","2026-07-01 03:43:37",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F815054e2-c575-439a-9a66-fce251b4da80?source=api-prod",1,[22,23,24,25,26,27,28,29],"README.txt","admin\u002Fcss\u002Fwprev_admin.css","admin\u002Fpartials\u002Fgooglecrawl.php","admin\u002Fpartials\u002Fgooglecrawl_dfs.php","freemius\u002FREADME.md","freemius\u002Fassets\u002Fcss\u002Fadmin\u002Faccount.css","freemius\u002Fassets\u002Fcss\u002Fadmin\u002Fconnect.css","freemius\u002Fassets\u002Fcss\u002Fadmin\u002Fdebug.css","researched",false,3,"# Exploitation Research Plan: CVE-2026-13015 (WP Google Review Slider)\n\n## 1. Vulnerability Summary\nThe **WP Google Review Slider** plugin (versions \u003C= 18.1) is vulnerable to **Reflected Cross-Site Scripting (XSS)**. The vulnerability exists in `admin\u002Fpartials\u002Fgooglecrawl_dfs.php`, where the `place` GET parameter is double-decoded and echoed into the `value` attribute of an HTML input field without proper attribute escaping. Although the file is within the admin directory and requires `manage_options` capabilities to view, an unauthenticated attacker can exploit this by tricking a logged-in administrator into clicking a malicious link.\n\n## 2. Attack Vector Analysis\n- **Target Endpoint:** WordPress Admin Dashboard\n- **Vulnerable File:** `admin\u002Fpartials\u002Fgooglecrawl_dfs.php`\n- **Vulnerable Page Slug:** Likely `wp-google-review-slider-google-crawl` (to be confirmed by searching for `add_menu_page` or inclusion of `googlecrawl_dfs.php`).\n- **Vulnerable Parameter:** `place` (via `$_GET`)\n- **Authentication Requirement:**\n    - **Attacker:** Unauthenticated (to craft and send the link).\n    - **Victim:** Authenticated Administrator (with `manage_options` capability).\n- **Preconditions:** The plugin must be active. The vulnerability triggers when the provided `place` is not found in the existing `wprev_google_crawls` option.\n\n## 3. Code Flow\n1.  **Entry Point:** The administrator visits the plugin's admin page (e.g., `wp-admin\u002Fadmin.php?page=wp-google-review-slider-google-crawl&place=[PAYLOAD]`).\n2.  **Capability Check:** `googlecrawl_dfs.php` (Line 13) checks `current_user_can('manage_options')`.\n3.  **Source:** `$_GET['place']` is retrieved and explicitly passed through `urldecode()` (Line 17), creating a **double-decoding** scenario since PHP auto-decodes `$_GET` once.\n    ```php\n    $currentplace = \"\";\n    if(isset($_GET['place'])){\n        $currentplace = urldecode($_GET['place']);\n    }\n    ```\n4.  **Logic Branch:** The code checks if `$currentplace` exists in the `wprev_google_crawls` option (Lines 34-40). If it does not exist, it falls into the `else if` block:\n    ```php\n    } else if(!isset($googlecrawlsarray[$currentplace]['enteredidorterms'])){\n        $savedplaceid = stripslashes($currentplace);\n    }\n    ```\n5.  **Sink:** The raw `$savedplaceid` is passed through `stripslashes()` and echoed directly into the `value` attribute of the `#gplaceid` input (Line 99).\n    ```php\n    \u003Cinput id=\"gplaceid\" ... value=\"\u003C?php echo stripslashes($savedplaceid); ?>\" ...>\n    ```\n6.  **Injection:** Since `esc_attr()` is missing, an attacker can use `\"` to break out of the attribute and inject tags like `\u003Cscript>` or event handlers like `onerror`.\n\n## 4. Nonce Acquisition Strategy\n**No nonce is required for this reflected XSS.**\nReflected XSS occurs during the rendering of a `GET` request. In WordPress, standard admin pages registered via `add_menu_page` perform capability checks but do not typically require a CSRF nonce just to view the page. The payload is executed immediately upon the administrator loading the page.\n\n## 5. Exploitation Strategy\n### Step 1: Identify the Admin Page Slug\nUse `grep` to find where `googlecrawl_dfs.php` is included to determine the exact `page` parameter.\n```bash\ngrep -r \"googlecrawl_dfs.php\" .\n```\n\n### Step 2: Craft the Payload\nBecause the code calls `urldecode()` on a value already decoded by PHP, we must use **double URL encoding** to ensure the payload survives and executes.\n-   **Target Tag Breakout:** `\">\u003Cimg src=x onerror=alert(document.domain)>`\n-   **Encoding:**\n    -   `\"` -> `%22` -> `%2522`\n    -   `>` -> `%3E` -> `%253E`\n    -   `\u003C` -> `%3C` -> `%253C`\n-   **Full Payload:** `place=%2522%253E%253Cimg%2520src%253Dx%2520onerror%253Dalert(document.domain)%253E`\n\n### Step 3: Execution\nThe automated agent will simulate an administrator session and navigate to the crafted URL using the `browser_navigate` tool.\n\n**Example Request:**\n-   **URL:** `http:\u002F\u002Flocalhost:8080\u002Fwp-admin\u002Fadmin.php?page=[SLUG]&place=%2522%253E%253Cimg%2520src%253Dx%2520onerror%253Dalert(document.domain)%253E`\n\n## 6. Test Data Setup\n1.  Install and activate **WP Google Review Slider** version 18.1.\n2.  Create an administrator user.\n3.  Ensure no existing crawl data for the payload exists (standard on a fresh install).\n\n## 7. Expected Results\n-   When the administrator navigates to the URL, the HTML source at the vulnerable input will look like:\n    ```html\n    \u003Cinput id=\"gplaceid\" ... value=\"\">\u003Cimg src=x onerror=alert(document.domain)>\" ...>\n    ```\n-   The browser will execute the `onerror` handler, triggering a JavaScript alert containing the site's domain.\n\n## 8. Verification Steps\n1.  **Browser Verification:** Use `browser_eval` to check if a global variable set by the payload (e.g., `window.pwned = 1`) exists, or observe the alert.\n2.  **Source Verification:** Use `http_request` as an admin to fetch the page and verify that the `place` parameter's content appears unescaped in the response body.\n    ```bash\n    # Check for the injected tag in the raw HTML\n    grep \"\u003Cimg src=x onerror=alert(document.domain)>\" \n    ```\n\n## 9. Alternative Approaches\n-   **Bypassing `stripslashes`:** If the environment has `magic_quotes` style behavior (unlikely in modern PHP but possible via other plugins), use `String.fromCharCode` for the JS payload to avoid quotes.\n-   **Tab Switching:** If the DFS page is not the default, check if `googlecrawl.php` (the other partial) has similar vulnerabilities. (Note: `admin\u002Fpartials\u002Fgooglecrawl.php` Line 63 uses `esc_attr(stripslashes($savedplaceid))`, indicating it is **not** vulnerable, highlighting the specific omission in `googlecrawl_dfs.php`).","The WP Google Review Slider plugin is vulnerable to Reflected Cross-Site Scripting (XSS) via the 'place' parameter in the 'googlecrawl_dfs.php' admin partial. This occurs because the plugin double-decodes the user-provided input and echoes it directly into an HTML attribute without proper sanitization or escaping, allowing attackers to execute arbitrary JavaScript in the context of an administrator's browser.","\u002F\u002F admin\u002Fpartials\u002Fgooglecrawl_dfs.php line 17\nif(isset($_GET['place'])){\n\t$currentplace = urldecode($_GET['place']);\n}\n\n---\n\n\u002F\u002F admin\u002Fpartials\u002Fgooglecrawl_dfs.php line 40\n} else if(!isset($googlecrawlsarray[$currentplace]['enteredidorterms'])){\n\t\u002F\u002F Handle case where we only have nhful and no other data - use the key as place ID\n\t$savedplaceid = stripslashes($currentplace);\n}\n\n---\n\n\u002F\u002F admin\u002Fpartials\u002Fgooglecrawl_dfs.php line 106\n\u003Cinput id=\"gplaceid\" style=\"width: 300px;\" value=\"\u003C?php echo stripslashes($savedplaceid); ?>\" class=\"w3-input w3-border w3-round\" type=\"text\" placeholder=\"e.g.: ChIJOUW7JL0RYogRgDxol-LP_sU\">","--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fwp-google-places-review-slider\u002F18.1\u002Fadmin\u002Fpartials\u002Fgooglecrawl_dfs.php\t2026-06-12 20:24:04.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fwp-google-places-review-slider\u002F18.2\u002Fadmin\u002Fpartials\u002Fgooglecrawl_dfs.php\t2026-06-29 14:48:56.000000000 +0000\n@@ -18,14 +18,14 @@\n     }\n \t\n \t$currentplace = \"\";\n-\tif(isset($_GET['place'])){\n-\t\t$currentplace = urldecode($_GET['place']);\n+\tif ( isset( $_GET['place'] ) ) {\n+\t\t$currentplace = sanitize_text_field( wp_unslash( urldecode( $_GET['place'] ) ) );\n \t}\n \t$editid=\"\";\n \t$editplace =\"\";\n-\tif(isset($_GET['ract']) && $_GET['ract']==\"edit\"){\n+\tif ( isset( $_GET['ract'] ) && 'edit' === sanitize_text_field( wp_unslash( $_GET['ract'] ) ) ) {\n \t\t$editidedit=\"edit\";\n-\t\t$editplace = urldecode($_GET['place']);\n+\t\t$editplace = $currentplace;\n \t}\n \t\n $googlecrawlsarray = Array();\n@@ -106,12 +106,12 @@\n     \u003Ch4>Google Search Terms or Place ID:\u003C\u002Fh4>\n   \u003C\u002Fdiv>\n   \u003Cdiv class=\" w3-cell w3-cell-middle w3-padding-small\">\n-    \u003Cinput id=\"gplaceid\" style=\"width: 300px;\" value=\"\u003C?php echo stripslashes($savedplaceid); ?>\" class=\"w3-input w3-border w3-round\" type=\"text\" placeholder=\"e.g.: ChIJOUW7JL0RYogRgDxol-LP_sU\">\n+    \u003Cinput id=\"gplaceid\" style=\"width: 300px;\" value=\"\u003C?php echo esc_attr( stripslashes( $savedplaceid ) ); ?>\" class=\"w3-input w3-border w3-round\" type=\"text\" placeholder=\"e.g.: ChIJOUW7JL0RYogRgDxol-LP_sU\">","An attacker crafts a malicious URL targeting the plugin's 'Connect Google Review Page' in the WordPress admin dashboard (e.g., \u002Fwp-admin\u002Fadmin.php?page=wp-google-review-slider-google-crawl). The 'place' parameter is populated with a double-URL-encoded payload designed to break out of an HTML input tag (e.g., \">%2522%253E%253Cscript%253Ealert(1)%253C\u002Fscript%253E\"). When an authenticated administrator clicks this link, the PHP code in googlecrawl_dfs.php decodes the value and echoes it unescaped into the 'value' attribute of the #gplaceid input field, causing the browser to execute the injected script.","gemini-3-flash-preview","2026-07-25 13:07:21","2026-07-25 13:08:17",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","18.1","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwp-google-places-review-slider\u002Ftags\u002F18.1","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fwp-google-places-review-slider.18.1.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwp-google-places-review-slider\u002Ftags\u002F18.2","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fwp-google-places-review-slider.18.2.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwp-google-places-review-slider\u002Ftags"]