Skip to content
Sign in
6.5 Medium

CVE-2026-84097 The wp-review-slider-pro WordPress plugin before 12.7.12 does not sanitize a value stored through one of its AJAX…

Description

The wp-review-slider-pro WordPress plugin before 12.7.12 does not sanitize a value stored through one of its AJAX handlers, which lacks a capability check, before using it in a SQL statement, allowing any authenticated user, such as a subscriber, to perform SQL injection attacks whose results are then returned to unauthenticated visitors.

Affected products and versions

Product Affected versions Fixed in
wp-review-slider-pro 12.7 earliest → < 12.7.12 12.7.12

Other CVEs of wp-review-slider-pro

The 3 CVEs of wp-review-slider-pro →
CVE-2026-84096 The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capability check on the AJAX handler that… 8.0 High CVE-2026-84095 The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capability check on one of its AJAX… 8.0 High
Track this CVE