CVE-2026-84097
wp-review-slider-pro: WP Review Slider Pro < 12.7.12 - Subscriber+ SQLi via Stored Template Filter
Unknown wp-review-slider-pro
CVSS
6.5MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 11% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 12.7.12wp-review-slider-proCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
The wp-review-slider-pro WordPress plugin before 12.7.12 does not sanitize a value stored through one of its AJAX handlers, which lacks a capability check, before using it in a SQL statement, allowing any authenticated user, such as a subscriber, to perform SQL injection attacks whose results are then returned to unauthenticated visitors.
Text from CVE List
Affected versions 1
- wp-review-slider-proaffected: all versions before 12.7.12CVE List