CVE-2026-32360: Rich Showcase Google Reviews XSS Flaw

CVE-2026-32360 Overview

A Stored Cross-Site Scripting (XSS) vulnerability has been identified in the Rich Showcase for Google Reviews WordPress plugin (widget-google-reviews). This vulnerability stems from improper neutralization of user-supplied input during web page generation, allowing attackers with elevated privileges to inject malicious scripts that persist in the application and execute in the browsers of other users.

Critical Impact

Attackers with high-level privileges can inject persistent malicious scripts that execute in victim browsers, potentially leading to session hijacking, credential theft, defacement, or malware distribution across WordPress sites using this plugin.

Affected Products

• Rich Showcase for Google Reviews (widget-google-reviews) versions through <= 6.9.4.3

Discovery Timeline

• 2026-03-13 - CVE CVE-2026-32360 published to NVD
• 2026-03-16 - Last updated in NVD database

Technical Details for CVE-2026-32360

Vulnerability Analysis

This Stored XSS vulnerability (CWE-79) affects the Rich Showcase for Google Reviews WordPress plugin, which is used to display Google Reviews on WordPress websites. The vulnerability allows authenticated attackers with high-level privileges (such as administrators) to inject malicious JavaScript code that gets stored persistently within the application.

Unlike reflected XSS attacks that require victims to click malicious links, stored XSS payloads persist in the application database and execute automatically when users view the affected pages. This makes the attack more dangerous as it can impact multiple users without requiring direct interaction with attacker-controlled content.

The cross-site scripting vulnerability exists due to insufficient input sanitization and output encoding when processing user-supplied data. When plugin settings or review content are saved without proper validation, malicious scripts can be stored and later rendered to other users visiting the affected pages.

Root Cause

The root cause of this vulnerability is the failure to properly sanitize and encode user-controlled input before storing it in the database and rendering it in HTML output. The Rich Showcase for Google Reviews plugin does not adequately neutralize special characters and script elements in user input, allowing JavaScript code to be embedded and executed in the context of other users' browser sessions.

WordPress plugins must implement both input validation (sanitization) when receiving data and output encoding (escaping) when displaying data to prevent XSS attacks. The absence of these controls in affected versions creates the stored XSS condition.

Attack Vector

The attack leverages network access and requires the attacker to have high-level privileges (PR:H) on the WordPress installation. The attack scenario involves:

1. An authenticated attacker with administrative or elevated privileges accesses the plugin's configuration or content management interface
2. The attacker injects malicious JavaScript payload into a vulnerable input field (e.g., widget settings, custom HTML, or review display configuration)
3. The malicious script is stored in the WordPress database without proper sanitization
4. When other authenticated users (including other administrators) or site visitors view pages containing the affected widget, the malicious script executes in their browser
5. The script can then perform actions such as stealing session cookies, redirecting users, modifying page content, or initiating further attacks

The scope change (S:C) indicates that the vulnerability can impact resources beyond the vulnerable component itself, potentially affecting the broader WordPress installation and its users.

Detection Methods for CVE-2026-32360

Indicators of Compromise

• Unusual JavaScript code present in plugin configuration fields or database entries related to widget-google-reviews
• Unexpected outbound network connections from visitor browsers when viewing pages with Google Reviews widgets
• Reports of browser security warnings or unexpected redirects on pages containing the plugin
• Modified plugin settings or database records in the wp_options table related to the Rich Showcase plugin

Detection Strategies

• Review WordPress database entries for the Rich Showcase plugin for suspicious <script> tags or JavaScript event handlers
• Implement Content Security Policy (CSP) headers to detect and block unauthorized script execution
• Monitor web application firewall (WAF) logs for XSS attack patterns targeting plugin endpoints
• Conduct regular security scans using WordPress security plugins that detect stored XSS vulnerabilities

Monitoring Recommendations

• Enable WordPress activity logging to track changes to plugin settings and configurations
• Configure browser-based XSS auditor alerts in development and staging environments
• Implement real-time monitoring for JavaScript execution from unexpected sources on pages with Google Reviews widgets
• Review server access logs for suspicious POST requests to plugin administration endpoints

How to Mitigate CVE-2026-32360

Immediate Actions Required

• Audit current plugin configuration for any signs of injected malicious scripts
• Review WordPress user accounts and revoke unnecessary administrative privileges
• Implement a Web Application Firewall (WAF) with XSS protection rules
• Consider temporarily disabling the Rich Showcase for Google Reviews plugin until a patched version is available

Patch Information

At the time of publication, users should check for updates to the Rich Showcase for Google Reviews plugin beyond version 6.9.4.3. Monitor the Patchstack WordPress Vulnerability Advisory for the latest patch information and remediation guidance from the plugin developers.

Workarounds

• Restrict administrative access to trusted users only and implement strong authentication (2FA) for all privileged accounts
• Implement Content Security Policy (CSP) headers with strict script-src directives to mitigate the impact of successful XSS attacks
• Use WordPress security plugins that provide virtual patching capabilities for known vulnerabilities
• Regularly backup WordPress databases to enable quick recovery if compromise is detected

# Example: Add CSP header in WordPress .htaccess or wp-config.php
# Add to .htaccess for Apache servers:
Header set Content-Security-Policy "default-src 'self'; script-src 'self' https://maps.googleapis.com; object-src 'none';"

# Or add to wp-config.php (requires appropriate plugin or code in functions.php):
# add_action('send_headers', function() {
#     header("Content-Security-Policy: default-src 'self'; script-src 'self' https://maps.googleapis.com; object-src 'none';");
# });