CVE-2026-12154 Overview
CVE-2026-12154 is a Stored Cross-Site Scripting (XSS) vulnerability in the Reviews Widgets for Google, Yelp & TripAdvisor plugin for WordPress. The flaw affects all plugin versions up to and including 2.7.3. Authenticated users with Contributor-level access or higher can inject arbitrary JavaScript through the page_id attribute of the [fbrev] shortcode. The injected payload executes in the browser of any user who visits a page containing the malicious shortcode. The vulnerability is tracked under CWE-79 and carries an EPSS probability of 0.193%.
Critical Impact
Contributor-level attackers can persist arbitrary JavaScript in WordPress pages, enabling session theft, administrative action forgery, and drive-by redirection targeting site visitors and administrators.
Affected Products
- Reviews Widgets for Google, Yelp & TripAdvisor (plugin slug fb-reviews-widget) versions ≤ 2.7.3
- WordPress sites where Contributor-or-higher accounts can publish content containing the [fbrev] shortcode
- Any front-end page rendering the vulnerable shortcode to unauthenticated visitors
Discovery Timeline
- 2026-07-06 - CVE-2026-12154 published to the National Vulnerability Database
- 2026-07-07 - Last updated in NVD database
Technical Details for CVE-2026-12154
Vulnerability Analysis
The vulnerability resides in the shortcode handler Feed_Shortcode::fbrev() at includes/class-feed-shortcode.php. The handler accepts the page_id attribute directly from user-supplied shortcode input without sanitization. The raw attribute value is then forwarded to Feed_Old::get_feed() in includes/class-feed-old.php, which propagates it to View::render() in includes/class-view.php. The rendering routine echoes the attribute into a data-id HTML attribute without invoking esc_attr(). Any attribute-breaking payload — such as a closing quote followed by an event handler — escapes the attribute context and lands in the executable HTML stream.
Root Cause
The root cause is missing output escaping on a user-controlled shortcode attribute. WordPress requires esc_attr() for values rendered inside HTML attributes, but the plugin writes the page_id value directly into the DOM. Input sanitization at the shortcode entry point is also absent, so both defensive layers fail simultaneously.
Attack Vector
An authenticated attacker holding a Contributor role or higher creates or edits a post containing an [fbrev page_id="..."] shortcode. The attacker crafts the page_id value to break out of the data-id attribute and inject a script payload. When the post is published or previewed and viewed by a site visitor or reviewer, the browser executes the injected script under the site's origin. This allows session cookie theft, forced administrative actions via CSRF, and arbitrary DOM manipulation. The scope change reflected in the CVSS vector indicates the payload can affect resources beyond the vulnerable component, such as an administrator's authenticated session.
Detection Methods for CVE-2026-12154
Indicators of Compromise
- Posts or pages containing [fbrev] shortcodes with page_id values embedding quote characters, angle brackets, or on* event handlers
- Unexpected <script> tags or javascript: URIs stored in wp_posts.post_content referencing the fbrev shortcode
- Outbound requests from visitor browsers to attacker-controlled domains sourced from pages rendering the plugin's widget
Detection Strategies
- Query the WordPress database for shortcodes matching the pattern \[fbrev[^\]]*page_id=["'][^"']*[<">][^"']*["']
- Inspect rendered pages for data-id attributes containing HTML metacharacters or script fragments
- Review Contributor and Author account activity for unusual post edits referencing the fb-reviews-widget plugin
Monitoring Recommendations
- Enable WordPress audit logging for post creation and revision events by non-administrator roles
- Monitor web application firewall telemetry for stored XSS signatures targeting shortcode attributes
- Alert on new external script sources appearing in the Content Security Policy report-only endpoint
How to Mitigate CVE-2026-12154
Immediate Actions Required
- Update the Reviews Widgets for Google, Yelp & TripAdvisor plugin to the version published in the WordPress Plugin Changeset 3593292 or later
- Audit all existing posts and pages for [fbrev] shortcodes containing suspicious page_id values and remove malicious content
- Rotate credentials for any administrator account that viewed a page containing an untrusted [fbrev] shortcode
Patch Information
The vendor addressed the flaw in the changeset referenced by the Wordfence Vulnerability Report. The fix introduces proper escaping around the data-id attribute in class-view.php and sanitization at the shortcode entry point in class-feed-shortcode.php.
Workarounds
- Temporarily deactivate the fb-reviews-widget plugin until the patched release is installed
- Restrict Contributor and Author roles from using the [fbrev] shortcode via a role capability plugin
- Deploy a Content Security Policy that disallows inline scripts and untrusted script sources to blunt payload execution
# Configuration example: disable the vulnerable shortcode site-wide via wp-cli
wp shortcode deregister fbrev
# Or remove the plugin entirely until patched
wp plugin deactivate fb-reviews-widget
wp plugin delete fb-reviews-widget
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
