CVE-2026-11969

Name of the Vulnerable Software and Affected Versions WP TripAdvisor Review Slider versions prior to 14.4

Description The plugin is subject to a generic SQL Injection, a technique where malicious SQL statements are inserted into entry fields for execution. This occurs due to insufficient escaping of user-supplied data and a lack of proper preparation of the SQL query. Authenticated attackers with administrator-level access or higher can exploit the curselrevs[] parameter to append additional queries and extract sensitive information from the database.

Recommendations Update the plugin to version 14.4 or later. As a temporary mitigation, restrict access to the administrative functions that utilize the curselrevs[] parameter.