CVE-2026-84096

Name of the Vulnerable Software and Affected Versions wp-review-slider-pro versions prior to 12.7.12

Description The plugin fails to perform a capability check on the AJAX handler used to save review submission forms. Additionally, the nonce (a unique token used to prevent replay attacks) is generated for every visitor. This allows any authenticated user, including those with subscriber-level privileges, to overwrite a live form with field values. Because these values are output on public pages without proper escaping, it leads to Stored Cross-Site Scripting (XSS), where malicious scripts are permanently stored on the server and executed in the browsers of other users.

Recommendations Update wp-review-slider-pro to version 12.7.12 or later.