VulnCheck KEV: CVE-2026-8441

The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'notinstring' parameter of the wprploadmorerevs AJAX action in versions up to, and including, 12.7.2. The parameter is read via $POST'notinstring' and passed through sanitizetextfield — which strips HTML and...

WordPress WP Review Slider Pro plugin < 12.7.12 - Subscriber+ Stored XSS vulnerability

Subscriber+ Stored XSS vulnerability discovered by Erwan LR WPScan in WordPress Plugin WP Review Slider Pro versions 12.7.12...

WordPress WP Review Slider Pro plugin < 12.7.12 - Subscriber+ Stored XSS vulnerability

Subscriber+ Stored XSS vulnerability discovered by Erwan LR WPScan in WordPress Plugin WP Review Slider Pro versions 12.7.12...

WordPress WP Review Slider Pro plugin < 12.7.12 - Subscriber+ SQLi vulnerability

Subscriber+ SQLi vulnerability discovered by Erwan LR WPScan in WordPress Plugin WP Review Slider Pro versions 12.7.12...

CVE-2026-84096

The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capability check on the AJAX handler that saves its review submission forms, and the nonce protecting it is generated for every visitor, allowing any authenticated user, such as a subscriber, to overwrite a live form with...

CVE-2026-84095

The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capability check on one of its AJAX handlers, and the nonce protecting it is generated for every visitor, allowing any authenticated user, such as a subscriber, to store arbitrary review content which is later output...

CVE-2026-84097

The wp-review-slider-pro WordPress plugin before 12.7.12 does not sanitize a value stored through one of its AJAX handlers, which lacks a capability check, before using it in a SQL statement, allowing any authenticated user, such as a subscriber, to perform SQL injection attacks whose results are...

EUVD-2026-87533

The wp-review-slider-pro WordPress plugin before 12.7.12 does not sanitize a value stored through one of its AJAX handlers, which lacks a capability check, before using it in a SQL statement, allowing any authenticated user, such as a subscriber, to perform SQL injection attacks whose results are...

CVE-2026-84096 WP Review Slider Pro < 12.7.12 - Subscriber+ Stored XSS via Review Form Fields

The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capability check on the AJAX handler that saves its review submission forms, and the nonce protecting it is generated for every visitor, allowing any authenticated user, such as a subscriber, to overwrite a live form with...

CVE-2026-84095

The wp-review-slider-pro WordPress plugin (versions before 12.7.12 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a lack of capability checks on an AJAX handler combined with a nonce that is generated for every visitor. This allows any authenticated user, such as a subsc...

CVE-2026-84096

The wp-review-slider-pro WordPress plugin, in versions prior to 12.7.12 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a missing capability check on the AJAX handler used to save review submission forms, combined with a nonce that is generated for every visitor. This all...

EUVD-2026-87532

The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capability check on the AJAX handler that saves its review submission forms, and the nonce protecting it is generated for every visitor, allowing any authenticated user, such as a subscriber, to overwrite a live form with...

CVE-2026-84095 WP Review Slider Pro < 12.7.12 - Subscriber+ Stored XSS via Review Import

The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capability check on one of its AJAX handlers, and the nonce protecting it is generated for every visitor, allowing any authenticated user, such as a subscriber, to store arbitrary review content which is later output...

EUVD-2026-87531

The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capability check on one of its AJAX handlers, and the nonce protecting it is generated for every visitor, allowing any authenticated user, such as a subscriber, to store arbitrary review content which is later output...

CVE-2026-84097

The wp-review-slider-pro WordPress plugin (versions before 12.7.12 ) is vulnerable to SQL injection . The root cause is a failure to sanitize a value stored via an AJAX handler that lacks a proper capability check. This allows any authenticated user , such as a subscriber, to perform SQL injectio...

CVE-2026-84097 WP Review Slider Pro < 12.7.12 - Subscriber+ SQLi via Stored Template Filter

The wp-review-slider-pro WordPress plugin before 12.7.12 does not sanitize a value stored through one of its AJAX handlers, which lacks a capability check, before using it in a SQL statement, allowing any authenticated user, such as a subscriber, to perform SQL injection attacks whose results are...

CVE-2026-84096 WP Review Slider Pro < 12.7.12 - Subscriber+ Stored XSS via Review Form Fields

The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capability check on the AJAX handler that saves its review submission forms, and the nonce protecting it is generated for every visitor, allowing any authenticated user, such as a subscriber, to overwrite a live form with...

CVE-2026-84097 WP Review Slider Pro < 12.7.12 - Subscriber+ SQLi via Stored Template Filter

The wp-review-slider-pro WordPress plugin before 12.7.12 does not sanitize a value stored through one of its AJAX handlers, which lacks a capability check, before using it in a SQL statement, allowing any authenticated user, such as a subscriber, to perform SQL injection attacks whose results are...

CVE-2026-84095 WP Review Slider Pro < 12.7.12 - Subscriber+ Stored XSS via Review Import

The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capability check on one of its AJAX handlers, and the nonce protecting it is generated for every visitor, allowing any authenticated user, such as a subscriber, to store arbitrary review content which is later output...

CVE-2026-84096: Improper Neutralization of Input During Web Page Generation

The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capability check on the AJAX handler that saves its review submission forms, and the nonce protecting it is generated for every visitor, allowing any authenticated user, such as a subscriber, to overwrite a live form with...