WordPress Plugin Vulnerabilities

WP Review Slider Pro < 12.7.12 - Subscriber+ Stored XSS via Review Import

Description

The plugin does not perform a capability check on one of its AJAX handlers, and the nonce protecting it is generated for every visitor, allowing any authenticated user, such as a subscriber, to store arbitrary review content which is later output without escaping on public pages, leading to Stored Cross-Site Scripting.

Proof of Concept

Affects Plugins

Plugin icon
wp-review-slider-pro
Fixed in 12.7.12

References

CVE
CVE-2026-84095

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
8.0 (high)

Miscellaneous

Original Researcher
Erwan LR (WPScan)
Submitter
Erwan LR (WPScan)
Verified
Yes
WPVDB ID
f788d50b-f507-4821-968e-9ea4f5ab71bd

Timeline

Publicly Published
2026-09-24 (about 2 days ago)
Added
2026-09-24 (about 1 day ago)
Last Updated
2026-09-24 (about 1 day ago)

Other

Published
Title
Published
2023-05-11
Title
eBecas <= 3.1.3 - Admin+ Stored XSS
Published
2026-01-27
Title
Prague < 2.2.9 - Unauthenticated Stored Cross-Site Scripting
Published
2025-04-04
Title
Arkhe Blocks <= 2.27.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-03-04
Title
Master Slider – Responsive Touch Slider < 3.10.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via ms_slider Shortcode
Published
2025-09-22
Title
DOAJ Export <= 1.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting