Reviews Feed < 2.6.5 – Unauthenticated Stored Arbitrary Shortcode Execution via Google Reviews | CVE 2026-10724

Description

The plugin does not neutralize WordPress shortcodes contained in third-party review content before rendering it through its dynamic block, allowing unauthenticated attackers to execute arbitrary shortcodes on pages that display the feed by planting a shortcode in a review on the connected source.

Proof of Concept

Prerequisites:
- Reviews Feed 2.6.0 active.
- An admin-configured Google reviews feed linked to a Google place/business the attacker can post a public review to.
- The feed displayed on a published page using the Reviews Feed block (Gutenberg block "sbr/sbr-feed-block"), NOT the [reviews-feed] classic shortcode.

Steps:
1. As an unauthenticated attacker, post a public Google review on the business linked to the target's feed, with review text containing a WordPress shortcode, e.g.:
     Great service! [gallery ids=1]
   (any registered shortcode works; on a stock site core shortcodes such as [gallery] and [embed] are available, plus any shortcode registered by other active plugins)
2. Wait for the plugin to fetch/cache the review (or the admin refreshes the feed).
3. Load the published page that renders the feed via the Reviews Feed block, as any visitor.

Result: the shortcode embedded in the review is executed server-side. The review text is output by the block render template through wp_kses_post( nl2br( ... ) ), which preserves the [shortcode] brackets; because the feed block is a dynamic block, WordPress renders it via do_blocks (the_content priority 9) and the resulting markup, still containing the [shortcode], is then expanded by do_shortcode (the_content priority 11). For [gallery ids=1] the response contains the rendered gallery markup (id='gallery-1' ...) instead of the literal text.

Note: <script> / event-handler injection via the review text is blocked by wp_kses_post; the impact is arbitrary WordPress shortcode execution, whose severity depends on the shortcodes registered on the target site. The classic [reviews-feed] shortcode is NOT affected (do_shortcode does not re-scan its own callback output); the dynamic-block render path is what introduces the second expansion pass.