CVE-2026-84095

Name of the Vulnerable Software and Affected Versions wp-review-slider-pro versions prior to 12.7.12

Description An issue exists where an AJAX handler fails to perform a capability check. Because the nonce protecting this handler is generated for every visitor, any authenticated user, including those with subscriber privileges, can store arbitrary review content. This content is subsequently rendered on public pages without proper escaping, resulting in Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server and executed in the browsers of other users.

Recommendations Update wp-review-slider-pro to version 12.7.12 or later.