CVE-2026-84096
Deferred Deferred - Pending Action

Stored XSS in WP Review Slider Pro WordPress Plugin

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: WPScan

Description
The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capability check on the AJAX handler that saves its review submission forms, and the nonce protecting it is generated for every visitor, allowing any authenticated user, such as a subscriber, to overwrite a live form with field values that are output without escaping on public pages, leading to Stored Cross-Site Scripting.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-10-16
AI Q&A
2026-09-26
EPSS Evaluated
2026-10-14
NVD
CVE-2026-84096
EUVD
EUVD-2026-87532

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wp_review_slider_pro wp_review_slider_pro to 12.7.12 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Stored Cross-Site Scripting (XSS) flaw in the wp-review-slider-pro WordPress plugin before version 12.7.12. It occurs because the plugin does not check user capabilities when saving review forms via AJAX and uses a predictable nonce for every visitor. This allows any authenticated user, including low-privilege subscribers, to inject malicious scripts into review forms that are later displayed without proper escaping on public pages.

Detection Guidance

Check the installed version of the wp-review-slider-pro plugin. If it is below 12.7.12, the system is vulnerable. Use WordPress admin panel or run a command like 'wp plugin list' in the WordPress directory to verify the version.

Impact Analysis

An attacker could exploit this to inject malicious scripts into your website's review forms. These scripts would execute when visitors view the affected pages, potentially stealing user sessions, redirecting to phishing sites, or defacing your website. Even low-privilege users like subscribers can exploit this, making it a significant risk for any site using the vulnerable plugin version.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by exposing user data through XSS attacks. GDPR requires protecting user data from unauthorized access or disclosure, while HIPAA mandates safeguards against malicious code that could compromise protected health information. Exploitation of this flaw may result in data breaches, triggering regulatory penalties and legal consequences.

Mitigation Strategies

Update the wp-review-slider-pro plugin to version 12.7.12 or later immediately. If updating is not possible, consider disabling the plugin temporarily until an update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84096. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart