CVE Watch1 jul 2026

CVE-2026-13015

The Wp Google Places Review Slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'place' parameter in version

CVSS

6.1

Medio

EPSS

0.4%

p31

KEV

—

Exploit Today

0-100

Publicado: 1 jul 2026 · Última mod.: 1 jul 2026 · CWE-79

EPSS · 30d

0.2%EPSS · 30 días0.4%

2026-08-202026-09-18

Descripción técnica

The Wp Google Places Review Slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'place' parameter in versions up to, and including, 18.1. This is due to insufficient input sanitization and output escaping in admin/partials/googlecrawl_dfs.php, where the $_GET['place'] value is URL-decoded, stripslashes()'d, and echoed directly into an HTML value attribute with no esc_attr() call when the supplied place is not already a stored key in the wprev_google_crawls option. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-929868.8 ALT

35.2%

——11SiYuan before 3.8.4 renders document titles as HTML in the backlink dock tree without escaping markup characters. Attackers can set malicious titles through the rename API or crafted notebooks to execute scripts in the Electron renderer with access to child_process for command execution.1d CVE-2026-634598.7 ALT

22.0%

——7Vendure is an open-source headless commerce platform. Prior to 3.6.5, RichTextDescriptionCell in packages/dashboard/src/lib/components/shared/table-cell/order-table-cell-components.tsx attempts to strip markup by assigning an administrator-controlled description to a live element's innerHTML and then reading textContent. Active resource markup can execute an event handler during the innerHTML assignment before textContent is read. A lower-privilege administrator can store such markup in descriptions rendered by the Products list, Collections list, Promotions list, Payment Methods list, or Shipping Methods list, and script executes when another administrator views the affected row. This stored cross-site scripting can compromise the viewing administrator's session and enable cross-privilege or cross-channel administrative actions. This issue is fixed in version 3.6.5.23h CVE-2026-909867.1 ALT

7.8%

——2Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.21 versions.23h CVE-2026-908877.1 ALT

7.8%

——2Unauthenticated Cross Site Scripting (XSS) in WP Inventory Manager <= 2.5.4 versions.23h CVE-2026-782946.5 MED

5.7%

——2Contributor Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions.23h CVE-2026-666176.5 MED

5.7%

——2Contributor Cross Site Scripting (XSS) in PublishPress Series <= 3.1.3 versions.23h