CVE-2026-15739 Overview
CVE-2026-15739 is a stored Cross-Site Scripting (XSS) vulnerability affecting the Rich Showcase for Google Reviews plugin for WordPress. The flaw exists in all versions up to and including 6.9.9 and stems from insufficient input sanitization and output escaping on the pagination shortcode attribute. Authenticated attackers with contributor-level access or higher can inject arbitrary JavaScript that executes when other users load the affected page. The issue is tracked under [CWE-79] (Improper Neutralization of Input During Web Page Generation).
Critical Impact
Contributor-level accounts can persist arbitrary JavaScript through the pagination shortcode attribute, enabling session theft, administrative account takeover, and unauthorized actions against visitors and site administrators.
Affected Products
- Rich Showcase for Google Reviews plugin for WordPress (slug: widget-google-reviews)
- All versions up to and including 6.9.9
- WordPress sites permitting contributor-level or higher accounts
Discovery Timeline
- 2026-07-24 - CVE-2026-15739 published to NVD
- 2026-07-24 - Last updated in NVD database
Technical Details for CVE-2026-15739
Vulnerability Analysis
The Rich Showcase for Google Reviews plugin exposes a shortcode that accepts a pagination attribute. User-supplied values passed to this attribute are not sufficiently sanitized on input and not properly escaped when written into the rendered HTML. As a result, an authenticated user with permission to create posts or pages can embed the shortcode with a crafted pagination value containing script content.
Once the post is viewed, the injected script runs in the browser context of any visitor, including administrators. Because the payload is stored server-side within post content, exploitation is persistent rather than reflected. Successful execution can be leveraged to perform actions such as stealing authenticated session cookies, hijacking privileged sessions, injecting additional malicious content, or pivoting to further site compromise through nonce theft and REST API abuse.
Root Cause
The root cause is missing sanitization of the pagination shortcode attribute and missing output escaping when the attribute value is rendered. Per the referenced source files in the plugin, the vulnerable handling occurs in includes/class-feed-shortcode.php, includes/class-feed-old.php, and includes/class-view.php. Neither sanitize_text_field() on input nor esc_attr() / esc_html() on output is applied to the attribute before it is emitted into the page markup.
Attack Vector
Exploitation requires network access to the WordPress site and authenticated access at the contributor role or higher. An attacker creates or edits a post containing the plugin shortcode and supplies a malicious pagination attribute value containing JavaScript. When the post is previewed or published and viewed by another user, the payload executes in that user's browser under the site's origin. No user interaction beyond visiting the affected page is required. See the Wordfence Vulnerability Report for additional technical context.
Detection Methods for CVE-2026-15739
Indicators of Compromise
- Posts, pages, or revisions containing the plugin shortcode with pagination values that include <script> tags, on*= event handlers, or javascript: URIs.
- Unexpected outbound requests from browser sessions to attacker-controlled domains initiated from pages rendering the plugin shortcode.
- Newly created administrator accounts or modified user roles following contributor account activity.
- Anomalous edits to posts by contributor-level accounts that embed the widget-google-reviews shortcode.
Detection Strategies
- Query the wp_posts table for shortcodes referencing the plugin and inspect pagination attribute values for HTML or script content.
- Enable and review WordPress audit logging for post creation and updates performed by contributor-role accounts.
- Deploy a Web Application Firewall (WAF) ruleset that flags shortcode attributes containing angle brackets, event handlers, or URL-encoded script payloads.
Monitoring Recommendations
- Monitor role changes and password resets for administrative accounts on affected WordPress installations.
- Alert on the installation of unknown plugins or themes following posts published by low-privilege users.
- Log and review Content Security Policy (CSP) violation reports for inline script execution on pages served by the plugin.
How to Mitigate CVE-2026-15739
Immediate Actions Required
- Update the Rich Showcase for Google Reviews plugin to a version later than 6.9.9 once released by the vendor.
- Audit all posts and pages using the plugin shortcode and remove any suspicious pagination attribute values.
- Restrict contributor and author role assignments to trusted users only, and review recent role grants.
- Rotate credentials and invalidate active sessions for administrators who may have viewed attacker-controlled content.
Patch Information
The vulnerability is present through version 6.9.9. The plugin repository shows related sanitization changes in the referenced WordPress Widget Revision Changeset. Site administrators should apply the vendor-released fix as soon as a patched version becomes available through the WordPress plugin directory.
Workarounds
- Temporarily deactivate the Rich Showcase for Google Reviews plugin until a patched version is installed.
- Remove contributor-level and above access for any accounts that do not strictly require post creation privileges.
- Deploy a Content Security Policy (CSP) that disallows inline scripts to reduce the impact of stored XSS.
- Enforce WAF rules that block shortcode parameters containing HTML tags or JavaScript event handlers.
# Example: disable the vulnerable plugin via WP-CLI until a patched release is available
wp plugin deactivate widget-google-reviews
wp plugin status widget-google-reviews
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
