Description

The WP Yelp Review Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Yelp Review Text (imported via wpyelp_download_source) in all versions up to, and including, 9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The malicious payload originates from an anonymous Yelp reviewer on a public platform and requires no WordPress account; it is introduced into the database during the site administrator's ordinary use of the plugin's Download Reviews feature, making the effective attacker unauthenticated.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-09-22T08:16:42.767Z",
  "pubdate": "2026-09-22T08:16:42.767Z",
  "executiveSummary": "The WP Yelp Review Slider plugin is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability affecting all versions up to and including 9.2.\nThe vulnerability arises from improper sanitization of Yelp review text during the plugin's data import process, allowing the injection of arbitrary malicious JavaScript.\nBecause the payload is ingested from a third-party source during the administrative 'Download Reviews' operation, the attack effectively circumvents authentication requirements.\nSuccessful exploitation occurs when an administrator triggers the review synchronization, leading to the persistent storage of malicious scripts within the WordPress database.\nOnce stored, these payloads execute within the browser context of any user visiting the affected page, leading to potential session hijacking, unauthorized actions, or site-wide defacement.\nThe risk is critical due to the unauthenticated nature of the initial vector and the high likelihood of automated administrative tasks triggering the payload execution.",
  "technicalDetails": "The vulnerability is a Stored XSS originating from the insecure handling of external data fetched via the Yelp API. The core issue lies within the wpyelp_download_source function, which processes and commits review text to the WordPress database without applying sufficient input sanitization or output encoding.\nThe attack vector is characterized by an unauthenticated third-party actor publishing a review containing malicious script tags on the public Yelp platform. When the target site administrator executes the 'Download Reviews' functionality, the plugin retrieves the malicious payload via the Yelp API and stores the unvalidated string into the WordPress database.\nThe vulnerable component is the processing logic responsible for sanitizing imported review metadata before database insertion and the corresponding output routine that renders the review text on the frontend. The application fails to sanitize the review content, effectively treating user-supplied external input as trusted HTML.\nExploitation flow: 1. An attacker crafts a malicious payload containing an XSS vector (e.g., <script>alert(document.cookie)</script>) and posts it as a review on the public Yelp business page associated with the target site. 2. The WordPress administrator initiates a manual or automated review update using the 'Download Reviews' feature. 3. The plugin invokes the wpyelp_download_source function, fetching the attacker's payload from the Yelp API. 4. The malicious content is written to the wp_options or custom post type table without sanitization. 5. Subsequent page views by any site visitor force the browser to parse and execute the stored JavaScript payload. 6. The browser executes the script under the security context of the victim's session, potentially compromising authentication tokens or sensitive information.\nThis vulnerability is classified as Stored XSS because the malicious script resides permanently within the database and persists across reloads. The lack of proper output encoding (e.g., using esc_html() or esc_js()) in the theme or plugin templates allows the browser to interpret the injected data as executable code rather than plain text. This poses a significant risk to site integrity and user data confidentiality, as the injected script inherits the origin permissions of the WordPress site."
}