CVE-2026-13015: WP Google Places Review Slider XSS Flaw

CVE-2026-13015 Overview

CVE-2026-13015 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Wp Google Places Review Slider plugin for WordPress. The flaw affects all versions up to and including 18.1. The vulnerable code path resides in admin/partials/googlecrawl_dfs.php, where the place GET parameter is reflected into an HTML attribute without proper escaping. Unauthenticated attackers can inject arbitrary JavaScript that executes in a victim's browser when the user is tricked into clicking a crafted link. The issue is tracked under [CWE-79] and carries a CVSS 3.1 base score of 6.1.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in an administrator's browser session, enabling session theft, forced actions, or persistent backdoor injection through admin-context requests.

Affected Products

Wp Google Places Review Slider plugin for WordPress
All versions up to and including 18.1
WordPress sites with the plugin active and accessible admin endpoints

Discovery Timeline

2026-07-01 - CVE-2026-13015 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-13015

Vulnerability Analysis

The vulnerability resides in admin/partials/googlecrawl_dfs.php within the Wp Google Places Review Slider plugin. The script accepts a place value from $_GET, applies urldecode() and stripslashes() transformations, and echoes the result directly into an HTML value attribute. The output is emitted without a call to esc_attr() when the supplied place string is not already present as a stored key in the wprev_google_crawls option. Because the sanitization branch is skipped for arbitrary attacker-supplied values, injected payloads reach the rendered DOM intact. Attackers exploit this by delivering a crafted URL to an authenticated WordPress user, most commonly a site administrator. When the target loads the URL, the injected script executes in the origin of the WordPress admin interface. This grants the attacker the ability to perform administrative actions, exfiltrate session cookies, or pivot to persistent site compromise.

Root Cause

The root cause is insufficient input sanitization and output escaping. The affected script trusts request parameters that fail the option-key lookup and reflects them into HTML output without contextual encoding. Missing esc_attr() on attribute-context output allows attribute-breakout payloads such as " onmouseover=... to execute.

Attack Vector

Exploitation requires network access to the WordPress site and user interaction from an authenticated victim. The attacker crafts a URL containing a malicious place parameter targeting the vulnerable admin partial. Delivery typically occurs through phishing emails, forum posts, or malicious referrers. Because the attack executes with the victim's privileges, targeting an administrator maximizes impact. See the Wordfence Vulnerability Report and the WordPress Plugin Code Review for the reflected sink location.

Detection Methods for CVE-2026-13015

Indicators of Compromise

Web server access logs containing requests to admin/partials/googlecrawl_dfs.php with place parameter values containing <, >, ", onerror=, onmouseover=, or javascript: tokens.
URL-encoded payloads such as %3Cscript%3E or %22%20onload%3D targeting the place query string.
Referer headers from external sites landing directly on the vulnerable admin partial URL.

Detection Strategies

Deploy a web application firewall rule inspecting the place GET parameter for HTML meta-characters and common XSS payload signatures.
Correlate authenticated admin sessions with unexpected outbound requests to attacker-controlled domains that could indicate exfiltrated cookies.
Audit the wprev_google_crawls WordPress option contents to identify whether stored keys are being abused as a bypass mechanism.

Monitoring Recommendations

Enable verbose HTTP access logging on /wp-admin/ paths and forward to a centralized log platform for pattern analysis.
Alert on any request to plugin admin partials originating from off-site referrers or unauthenticated IP ranges.
Monitor WordPress admin user account activity for unusual configuration changes, new user creation, or plugin installations following suspicious link clicks.

How to Mitigate CVE-2026-13015

Immediate Actions Required

Update the Wp Google Places Review Slider plugin to a version newer than 18.1 once the vendor publishes a fixed release.
Restrict access to /wp-admin/ endpoints using IP allowlists or authentication proxies where feasible.
Instruct WordPress administrators to avoid clicking untrusted links while logged into the site.

Patch Information

The vendor changeset addressing the flaw is tracked in the WordPress Plugin Change Log. Site operators should install the patched release from the WordPress plugin repository. Confirm the deployed plugin version reports a build higher than 18.1 after upgrade.

Workarounds

Deactivate the Wp Google Places Review Slider plugin until a patched release is installed.
Deploy a WAF rule that blocks requests to admin/partials/googlecrawl_dfs.php containing angle brackets, quotes, or on*= event-handler substrings in the place parameter.
Enforce a strict Content Security Policy that disallows inline script execution in the WordPress admin origin to reduce XSS impact.

bash

# Example ModSecurity rule blocking suspicious 'place' parameter values
SecRule ARGS:place "@rx (?i)(<script|onerror=|onmouseover=|javascript:|%3Cscript)" \
    "id:1013015,phase:2,deny,status:403,log,\
    msg:'CVE-2026-13015 - Reflected XSS attempt in wp-google-places-review-slider place parameter'"