CVE-2026-84095: WP Review Slider Pro < 12.7.12 - Subscriber+ Stored XSS via Review Import
The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capability check on one of its AJAX handlers, and the nonce protecting it is generated for every visitor, allowing any authenticated user, such as a subscriber, to store arbitrary review content which is later output without escaping on public pages, leading to Stored Cross-Site Scripting.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WordPress user can exploit it, including users with only the Subscriber role. The affected AJAX handler lacks a capability check, and its nonce is available to every visitor.
Does exploitation require the attacker to be able to publish content directly?
No. A low-privileged authenticated user can submit arbitrary review content through the vulnerable review-import functionality, which is later rendered on public pages without escaping.
Who is exposed to the stored script payload?
Visitors to public pages that display the attacker-controlled imported review content may execute the stored script in their browser.
How can administrators determine whether they may be affected?
Sites using WP Review Slider Pro versions earlier than 12.7.12 may be affected. Administrators should also review imported review content for unexpected or suspicious markup or scripts.