CVE-2026-93778

Name of the Vulnerable Software and Affected Versions WP Yelp Review Slider versions prior to 9.3

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting. The issue occurs when the plugin imports Yelp review text via the wpyelp download source function. A malicious payload can be created by an anonymous reviewer on the public Yelp platform and is subsequently introduced into the WordPress database when a site administrator uses the Download Reviews feature. This allows the execution of arbitrary web scripts in the browsers of users who access the affected pages.

Recommendations Update WP Yelp Review Slider to version 9.3 or later.