CVE-2026-84096: WP Review Slider Pro < 12.7.12 - Subscriber+ Stored XSS via Review Form Fields
The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capability check on the AJAX handler that saves its review submission forms, and the nonce protecting it is generated for every visitor, allowing any authenticated user, such as a subscriber, to overwrite a live form with field values that are output without escaping on public pages, leading to Stored Cross-Site Scripting.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WordPress user can exploit it, including users with only Subscriber-level access. The attacker must be able to obtain a valid nonce, but the plugin generates that nonce for every visitor.
What access or configuration is required for the malicious script to run?
The attacker can overwrite a live review submission form through the affected AJAX handler. Script execution occurs when the unescaped field values are rendered on public pages, so publicly displayed review forms are exposed.
Which versions need remediation?
Versions of WP Review Slider Pro before 12.7.12 are affected. Updating to 12.7.12 or later addresses the described missing capability check and unsafe output handling.
How can I check whether my site may have been compromised?
Review live review submission forms for unexpected or modified field values, especially values containing HTML or JavaScript. Also investigate changes made through the plugin's form-saving functionality by low-privileged authenticated accounts.