EUVD-2026-14160
GHSA-6gc7-2mhh-r959
Severity by source
AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The Review Map by RevuKangaroo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
AnalysisAI
The Review Map by RevuKangaroo WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability in its plugin settings that allows authenticated administrators to inject arbitrary JavaScript code through insufficient input sanitization and output escaping. This vulnerability affects all versions up to and including 1.7 and only manifests in WordPress multisite installations or single-site installations where the unfiltered_html capability has been disabled. Once injected, the malicious script executes whenever any user accesses the affected page, making this a persistent XSS attack vector that can compromise user sessions and sensitive data.
Technical ContextAI
The vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation), where the plugin fails to properly sanitize user inputs and escape output when storing and rendering plugin settings data. Based on the referenced code lines (233, 158, 162, 247, 253, 296 in the main plugin file), the issue appears to occur in the settings handling and output rendering functions within the Review Map by RevuKangaroo plugin (CPE: cpe:2.3:a:revukangaroo:review_map_by_revukangaroo:*:*:*:*:*:*:*:*). The vulnerability is technically exploitable because WordPress's unfiltered_html capability—which normally allows administrators to bypass HTML sanitization—is either disabled or not available in multisite configurations, meaning administrator inputs are processed through the content sanitization pipeline but not properly escaped when output to the DOM, leaving a gap where stored XSS can persist.
RemediationAI
Update the Review Map by RevuKangaroo plugin to a version newer than 1.7 that includes proper input sanitization and output escaping of plugin settings (check the WordPress plugin repository for the patched version release). Until the plugin is updated, WordPress administrators should restrict access to the plugin settings page to only the most trusted administrator accounts, implement role-based access controls to prevent lower-privileged administrators from modifying plugin settings, and monitor the WordPress admin audit logs for suspicious changes to Review Map settings. In multisite installations, network administrators should enforce security policies requiring all plugins to be kept current and consider temporarily disabling the Review Map by RevuKangaroo plugin on subsites until a patch is confirmed available. Additionally, implementing Web Application Firewalls (WAF) with XSS detection rules can provide a secondary layer of protection against the execution of injected scripts.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today