Stored Cross-Site Scripting Vulnerability in wp-review-slider-pro Plugin by WordPress
CVE-2026-84096
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 26 September 2026
Badges
What is CVE-2026-84096?
The wp-review-slider-pro plugin for WordPress prior to version 12.7.12 contains a security flaw in its AJAX handler, which saves review submission forms. The vulnerability arises due to the lack of a proper capability check, enabling any authenticated user to manipulate live forms. This is further compounded by nonce tokens that are generated per visitor, allowing attackers to overwrite form values that are outputted unsanitized on public pages. This scenario presents a significant risk of Stored Cross-Site Scripting, as it permits injection of malicious scripts, compromising the security of affected WordPress sites.
Affected Version(s)
wp-review-slider-pro 0 < 12.7.12
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.