CVE-2026-84097

Name of the Vulnerable Software and Affected Versions wp-review-slider-pro versions prior to 12.7.12

Description An issue exists where a value stored through an AJAX handler is not sanitized before being used in a SQL statement. The handler also lacks a capability check, which allows any authenticated user, including those with subscriber-level privileges, to execute SQL injection attacks. The results of these attacks are subsequently displayed to unauthenticated visitors.

Recommendations Update wp-review-slider-pro to version 12.7.12 or later.