WP Google Review Slider CVE-2026-39451

The WP Google Review Slider plugin must be installed and active on a WordPress site running version 18.0 or below. No authentication is required of the attacker (PR:N per CVSS vector), but exploitation is contingent on a victim user loading the crafted page in their browser (UI:R). This limits mass exploitation to scenarios where the attacker can deliver a malicious URL to targeted users. Exploitation is constrained to the scope of the victim's browser session (S:U - no server-side privilege escalation). Sites that have disabled the plugin or restricted access to affected plugin pages via access controls are not exploitable through this vector.

The NVD CVSS 3.1 score of 6.3 (Medium) reflects a balanced risk profile: network-accessible (AV:N), low complexity (AC:L), and no authentication required (PR:N), but limited by the requirement for user interaction (UI:R) and unchanged scope (S:U). Confidentiality, integrity, and availability impacts are all scored at Low, which is consistent with a reflected XSS that can steal session cookies or perform actions on behalf of the victim but does not directly compromise the underlying server. No EPSS data was provided in the intelligence input, so exploitation probability cannot be quantified. The absence of a CISA KEV listing and no identified public proof-of-concept suggests this is not under active widespread exploitation at time of analysis. Real-world risk is moderate: WordPress plugins with unauthenticated XSS are frequently targeted in bulk scanning campaigns, and the low attack complexity makes this straightforward to exploit once the vulnerability is publicly known. The Patchstack disclosure increases the likelihood of future automated exploitation attempts.

An attacker identifies a WordPress site running WP Google Review Slider 18.0 or earlier and crafts a URL containing a malicious JavaScript payload injected into a vulnerable parameter handled by the plugin. The attacker distributes this URL via phishing email, forum post, or social engineering targeting site visitors or administrators. When the victim clicks the link and their browser renders the page, the injected script executes - potentially stealing session cookies, performing actions under the victim's identity, or redirecting to a credential-harvesting page. No public proof-of-concept has been identified, but the low complexity (AC:L) means this is straightforward for any attacker familiar with XSS techniques.