WP-Safety
CVE-2026-0563

WP Google Street View (with 360° virtual tour) & Google maps + Local SEO <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpgsv_map' Shortcode

mediumImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
6.4
CVSS Score
6.4
CVSS Score
medium
Severity
1.1.9
Patched in
1d
Time to patch

Description

The WP Google Street View (with 360° virtual tour) & Google maps + Local SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpgsv_map' shortcode in all versions up to, and including, 1.1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS Vector Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Low
Confidentiality
Low
Integrity
None
Availability

Technical Details

Affected versions<=1.1.8
PublishedJanuary 8, 2026
Last updatedJanuary 9, 2026
Affected pluginwp-google-street-view

What Changed in the Fix

Changes introduced in v1.1.9

Loading patch diff...

Source Code

WordPress.org SVN
Vulnerable v1.1.8
Browse source Download .zip
Patched v1.1.9
Browse source Download .zip
Research Plan
Unverified

### 1. Vulnerability Summary The **WP Google Street View** plugin (versions <= 1.1.8) is vulnerable to **Authenticated Stored Cross-Site Scripting (XSS)** via the `[wpgsv_map]` and `[wpgsv]` shortcodes. While the plugin's PHP code attempts to escape shortcode attributes and post metadata using `esc_…

Show full research plan

1. Vulnerability Summary

The WP Google Street View plugin (versions <= 1.1.8) is vulnerable to Authenticated Stored Cross-Site Scripting (XSS) via the [wpgsv_map] and [wpgsv] shortcodes. While the plugin's PHP code attempts to escape shortcode attributes and post metadata using esc_attr() before rendering them into HTML data- attributes, the client-side JavaScript (assets/js/app.js) retrieves these values and injects them into the DOM or Google Maps components (like InfoWindow) without further sanitization.

This allows an attacker with Contributor-level permissions or higher to inject malicious scripts into a page by embedding a shortcode with a crafted payload. The script will execute in the browser of any user viewing the page.

2. Attack Vector Analysis

  • Shortcode: [wpgsv_map]
  • Vulnerable Attribute: info (rendered as data-address)
  • Alternative Shortcode: [wpgsv] (requires a wpgsv post ID; uses unsanitized textarea meta fields)
  • Authentication Level: Contributor+ (any user capable of creating or editing posts/pages).
  • Sink: Client-side JavaScript (Vue.js or Google Maps API) processing the data-address attribute.

3. Code Flow

  1. Entry Point: An authenticated
References
https://www.wordfence.com/threat-intel/vulnerabilities/id/2bc8a3fb-176e-4bf0-b96e-6ccb9688254b?source=api-prod

Check if your site is affected.

Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.

Run free audit Browse CVE database