Analysis Report Folder Analysis cache/wp-google-street-view_1.1.8 → cache/wp-google-street-view_1.1.9 - CVE-2026-0563

I'll analyze this security fix in the WordPress Google Street View plugin.

---

**Vulnerability Existed: yes**
TRUE POSITIVE

**Cross-Site Scripting (XSS) - CWE-79 - admin/metabox.php [Line 74]**

**Old Code:**
```php
update_post_meta( $postid, $key, trim($value) );
```

**Fixed Code:**
```php
update_post_meta( $postid, $key, wp_kses_post($value) );
```

**Explanation:**

The original code used only `trim()` on user-supplied textarea input before storing it as post metadata. This is insufficient sanitization for content that may be displayed in the WordPress admin or frontend. The `trim()` function only removes whitespace and does not prevent malicious HTML or JavaScript from being stored.

The fix applies `wp_kses_post()`, which is WordPress's standard function for sanitizing post content. This function:
1. Strips out dangerous HTML tags and attributes
2. Prevents inline JavaScript execution
3. Allows safe HTML tags commonly used in post content (like `<p>`, `<a>`, `<strong>`, etc.)

This fixes a **Stored XSS vulnerability** where an authenticated user (with permissions to edit posts using this metabox) could inject malicious JavaScript that would execute when the metadata is displayed in the admin panel or on the frontend, potentially affecting other users viewing that content.

The vulnerability severity depends on the intended use case of this textarea field - if it's meant to store HTML content, this is the appropriate sanitization function for that purpose.

Let me analyze the diff directly based on the content provided.

---

## Security Analysis of Code Diff

### Vulnerability 1: Improper HTML Sanitization

**Vulnerability Existed:** yes
FALSE POSITIVE

**Improper HTML Encoding - CWE-79 (Cross-site Scripting) - includes/shortcode.php - Lines 47-51**

**Old Code:**
```php
$metadata[$key] = esc_attr( $value[0] );
```

**Fixed Code:**
```php
if ( in_array( $key, WPGSV_Validate::$textarea ) ) {
    $metadata[$key] = esc_attr( wp_kses_post( $value[0] ) );
} else {
    $metadata[$key] = esc_attr( $value[0] );
}
```

**Explanation:**
The old code applied `esc_attr()` uniformly to all fields, including textarea fields. However, `esc_attr()` is designed for escaping HTML attributes and strips HTML entities, making it inappropriate for textarea content that may legitimately contain HTML formatting. The fix correctly identifies textarea fields and applies `wp_kses_post()` before `esc_attr()`, which allows safe HTML while removing malicious content. This addresses potential data loss and improper sanitization for fields that should support HTML content.

---

### Vulnerability 2: Incorrect Function Nesting for Data Attribute

**Vulnerability Existed:** not sure

**Improper HTML Encoding - CWE-79 (Cross-site Scripting) - includes/shortcode.php - Line 119**

**Old Code:**
```php
'data-address' => esc_attr( $atts['info'] ),
```

**Fixed Code:**
```php
'data-address' => esc_attr( wp_kses_post( $atts['info'] ) ),
```

**Explanation:**
This change applies `wp_kses_post()` before `esc_attr()` to the 'info' field. However, there is concern about the logic here: `wp_kses_post()` is meant to allow safe HTML tags, but when nested inside `esc_attr()`, the HTML tags will be entity-encoded, defeating the purpose of `wp_kses_post()`. This may indicate a misunderstanding of the intended use—if the field is meant to be used as an HTML attribute value (which data attributes typically are), then `esc_attr()` alone is appropriate. If it's meant to display HTML content elsewhere, then `wp_kses_post()` should be applied without `esc_attr()`. The current fix may introduce redundant processing but likely doesn't create a vulnerability—the nested calls result in safe output.

I'll analyze the provided code diff for security vulnerabilities.

```
Vulnerability Existed: no
No Vulnerabilities Detected

Explanation:
The diff shows only metadata changes to the WordPress plugin header:
- Addition of a "Plugin URI" field pointing to https://better-robots.com/product/wp-google-street-view/
- Version bump from 1.1.8 to 1.1.9

These are benign changes to plugin documentation fields. The Plugin URI field is a standard WordPress plugin header that simply provides a URL for users to learn more about the plugin. There are no code changes, no new functionality, no input handling modifications, and no security-related alterations that would introduce or fix vulnerabilities.

This appears to be a routine plugin maintenance update with documentation updates only.
```