WP Yelp Review Slider CVE-2026-93778

Requires the WP Yelp Review Slider plugin (versions up to and including 9.2) installed and the site administrator actively using the plugin's Download Reviews / import feature (wpyelp_download_source) to pull reviews from Yelp. The attacker must be able to publish a review containing the payload on the target business's public Yelp listing (no WordPress account needed). Limiting factors: the payload only reaches the database if and when the admin performs an import, and it only executes against users who subsequently visit a page rendering the affected slider template - so a site that never imports reviews, or has already sanitized/updated, is not exposed. The vendor's UI:N does not capture this required admin import action.

This is a genuine but conditional web-application risk, not an internet-scale emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2 HIGH) reflects a stored XSS where the effective attacker needs no WordPress account because the malicious payload is authored anonymously on Yelp and later ingested by the site itself. No EPSS score, no CISA KEV listing, and no public exploit code (POC) were provided, so exploitation is best characterized as 'no public exploit identified at time of analysis.' The absence of EPSS/KEV is consistent with a niche WordPress review-widget plugin rather than a mass-exploited target. One signal to scrutinize: the vendor sets UI:N, yet the injection path actually depends on a site administrator running the plugin's Download Reviews import - a required human action by a second party. Under strict CVSS scoring that admin step is arguably UI:R (which would lower the base to roughly 6.1), so the 7.2 should be read as a slight over-statement of how push-button the attack is. Net: a real priority for sites running this plugin and importing reviews, but the multi-step, operator-dependent chain keeps real-world risk moderate rather than critical.

An attacker posts a Yelp review on a target business's public Yelp page containing a script payload (e.g., an <img onerror=...> or <script> tag) instead of ordinary review text. When the WordPress site administrator later uses the plugin's Download Reviews feature (wpyelp_download_source) to sync Yelp reviews, the unsanitized payload is stored in the database and rendered unescaped in the front-end slider template, executing in the browser of every visitor who views the page. No public exploit code is identified, but the technique is trivial and requires no WordPress credentials.