CVE-2026-13015

Name of the Vulnerable Software and Affected Versions Wp Google Places Review Slider versions prior to 18.2

Description Reflected Cross-Site Scripting occurs due to insufficient input sanitization and output escaping in the file admin/partials/googlecrawl dfs.php. The place parameter is URL-decoded and processed with stripslashes(), then echoed directly into an HTML value attribute without using esc attr() when the value is not a stored key in the wprev google crawls option. This allows unauthenticated attackers to inject arbitrary web scripts that execute if a user clicks a specially crafted link.

Recommendations Update Wp Google Places Review Slider to version 18.2 or later. As a temporary mitigation, restrict access to the admin/partials/googlecrawl dfs.php file.