Stored XSS in Reviews Widgets for Google Yelp & TripAdvisor WordPress Plugin

Executive Summary

The vulnerability exists in the Reviews Widgets for Google, Yelp & TripAdvisor plugin for WordPress, specifically in versions up to and including 2.7.3. It is a Stored Cross-Site Scripting (XSS) issue that occurs via the 'page_id' shortcode attribute of the [fbrev] shortcode.

This happens because the plugin does not properly sanitize or escape the input for the 'page_id' attribute. The raw attribute value is passed through several methods and eventually echoed directly into an HTML attribute without proper escaping, allowing an attacker to inject malicious scripts.

Authenticated users with contributor-level access or higher can exploit this to inject arbitrary web scripts into pages, which will execute whenever any user accesses those pages.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows authenticated attackers with contributor-level access or above to inject malicious scripts into WordPress pages via the vulnerable shortcode attribute.

When other users visit the affected pages, the injected scripts will execute in their browsers. This can lead to theft of user credentials, session hijacking, defacement, or other malicious actions depending on the attacker's intent.

Because the vulnerability requires contributor-level access, it may be exploited by insiders or compromised accounts, increasing the risk within an organization.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves Stored Cross-Site Scripting via the 'page_id' shortcode attribute of the [fbrev] shortcode in the Reviews Widgets for Google, Yelp & TripAdvisor WordPress plugin. Detection would involve identifying pages or posts that include the vulnerable shortcode with potentially malicious script injections.

Since the vulnerability requires contributor-level access to inject scripts, monitoring for unusual shortcode usage or unexpected script tags in page content could help detect exploitation.

Specific commands or automated detection scripts are not provided in the available information.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting contributor-level access to trusted users only, as the vulnerability requires authenticated users with contributor-level permissions or higher to exploit.

Additionally, monitoring and sanitizing any shortcode attributes before rendering, or disabling the vulnerable plugin until an update is available, are prudent measures.

Updating the Reviews Widgets for Google, Yelp & TripAdvisor plugin to a version later than 2.7.3, once available, will address the vulnerability by fixing the insufficient input sanitization and output escaping.

Useful 0 Not Useful 0