CVE-2026-13015 is a reflected cross-site scripting vulnerability in the WP Google Places Review Slider plugin for WordPress. The issue arises from improper neutralization of input in the 'place' parameter handled in admin/partials/googlecrawl_dfs.php. Specifically, the $_GET['place'] value is URL-decoded and stripslashes()'d but then output directly into an HTML value attribute without esc_attr() escaping when the input is not a stored key in the wprev_google_crawls option. This allows unauthenticated attackers to inject arbitrary JavaScript that executes in the context of users who interact with a crafted link. The vulnerability affects versions up to and including 18.1. No official patch or remediation level has been provided yet.

Successful exploitation allows an unauthenticated attacker to perform reflected cross-site scripting attacks, leading to limited confidentiality and integrity impact by executing arbitrary scripts in the victim's browser. This can result in actions such as session hijacking or content manipulation within the affected web application context. There is no impact on availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid clicking on untrusted links that may exploit this vulnerability. Monitor the vendor's communications for updates and apply any official patches once released.