{
 "id": "WPSEC-2026-2519",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2519/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2519/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2519/index.md",
 "title": "Google Review Slider <= 18.10 - Cross-Site Request Forgery to Google Places Configuration Update",
 "description": "The WP Google Review Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery via the Google Places API settings page ('ract=edit' and 'settings-updated' parameters) in all versions up to, and including, 18.10, due to missing nonce validation before the page writes the active and saved Google Places configuration options. This makes it possible for unauthenticated attackers to switch the active Google Places configuration to another saved location, or blank it by supplying an unknown place ID, and to rewrite the stored multi-location configuration via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.",
 "plugin": {
  "slug": "wp-google-places-review-slider",
  "name": "Google Review Slider",
  "full_name": "WP Google Review Slider",
  "wordpress_org": "https://wordpress.org/plugins/wp-google-places-review-slider/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-google-places-review-slider/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-google-places-review-slider"
 },
 "type": "CSRF",
 "cwe": [
  "CWE-352"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "14.7",
    "from_inclusive": true,
    "to": "18.11",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 14.7 before 18.11"
  ]
 },
 "introduced_in": "14.7",
 "fixed_in": "18.11",
 "remediation": "Update to 18.11 or later.",
 "fix_released": "2026-11-03T17:56:53+00:00",
 "published": "2026-11-04T18:43:27+00:00",
 "updated": "2026-11-04T13:57:25.464490+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2519/",
  "https://plugins.svn.wordpress.org/wp-google-places-review-slider/tags/18.11/",
  "https://wordpress.org/plugins/wp-google-places-review-slider/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-google-places-review-slider",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-04"
 }
}