Stored XSS in WP Yelp Review Slider Plugin

The WP Yelp Review Slider plugin for WordPress, in versions up to and including 9.2, contains a critical input sanitization flaw that leads to Stored Cross-Site Scripting (XSS). An attacker can submit a crafted, malicious Yelp review on the public Yelp platform which is then fetched by the site administrator using the plugin's 'Download Reviews' feature. Because the plugin fails to sanitize the 'wpyelp_download_source' data upon import and lacks output escaping on the display side, the injected script is stored directly in the WordPress database. When a user visits the page where the reviews are displayed, the script executes in their browser session. This vulnerability is particularly dangerous because it does not require the attacker to have WordPress credentials, and the execution occurs automatically when administrative or end-user sessions view the content.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of a victim's browser session. This can lead to session hijacking, unauthorized actions performed on behalf of the logged-in user, and potential defacement or redirection of the affected WordPress site. Because the payload can execute whenever a user views the site, the impact extends to both site administrators and site visitors, potentially affecting all users of the platform.

Recommendation

1. Upgrade the WP Yelp Review Slider plugin to version 9.3 or later immediately upon vendor release to resolve the input sanitization flaw.
2. Implement a strict Content Security Policy (CSP) to restrict script execution sources and mitigate the impact of potential XSS attacks.
3. Perform a database audit for the 'wpyelp' review table entries to identify and remove any stored scripts if the plugin has been used to import reviews recently.