Wp Review Slider Pro
Monthly
Stored cross-site scripting in the WP Review Slider Pro WordPress plugin (versions before 12.7.12) allows any authenticated user, including a Subscriber, to overwrite a live review submission form with unescaped field values because the AJAX save handler performs no capability check and issues a nonce to every visitor. A victim who later views the compromised public form has the injected script executed in their browser (user interaction required), yielding low confidentiality and integrity impact as assessed by CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. Publicly available exploit code exists per WPScan, CISA's SSVC assessment records no observed exploitation, EPSS is only 0.16% (4th percentile), and a vendor patch is available in version 12.7.12.
Stored cross-site scripting in the WordPress plugin WP Review Slider Pro (wp-review-slider-pro) before 12.7.12 allows any authenticated user - including a low-privileged Subscriber - to persist arbitrary markup into review content that is later rendered without output escaping on public pages, executing script in the browser of any visitor who views them. The root cause is a missing capability check on an AJAX handler combined with a nonce that is issued to every visitor and therefore provides no authorization boundary; the published CVSS vector is network-reachable with low privileges and requires user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:R), and although the reporting source scored it 8.0, an independent assessment scores it considerably lower (S:C/C:L/I:L/A:N) because impact is confined to the victim's browser session within the site origin. Publicly available exploit code exists, but there is no confirmed active exploitation (CISA SSVC exploitation: none) and EPSS is low at 0.16% (4th percentile); a vendor patch is available in version 12.7.12.
SQL injection in the WordPress plugin WP Review Slider Pro (wp-review-slider-pro) before 12.7.12 allows any authenticated user - including a low-privileged Subscriber - to inject arbitrary SQL into a plugin AJAX handler and read data from the site's database; because the queried results are then rendered to unauthenticated visitors, the extracted data can be exposed publicly rather than being confined to the attacker's own session. Exploitation requires a valid account on the target site (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 6.5), which is trivial on sites that permit self-registration but blocked where registration is closed, and publicly available exploit code exists (no CISA KEV entry and no confirmed active exploitation; EPSS 0.16%, 5th percentile). Impact is confidentiality-only - no integrity or availability effect - but the leak-to-anonymous-visitors behavior makes this a genuine moderate-priority issue rather than a purely theoretical one.
Stored cross-site scripting in the WP Review Slider Pro WordPress plugin (versions before 12.7.12) allows any authenticated user, including a Subscriber, to overwrite a live review submission form with unescaped field values because the AJAX save handler performs no capability check and issues a nonce to every visitor. A victim who later views the compromised public form has the injected script executed in their browser (user interaction required), yielding low confidentiality and integrity impact as assessed by CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. Publicly available exploit code exists per WPScan, CISA's SSVC assessment records no observed exploitation, EPSS is only 0.16% (4th percentile), and a vendor patch is available in version 12.7.12.
Stored cross-site scripting in the WordPress plugin WP Review Slider Pro (wp-review-slider-pro) before 12.7.12 allows any authenticated user - including a low-privileged Subscriber - to persist arbitrary markup into review content that is later rendered without output escaping on public pages, executing script in the browser of any visitor who views them. The root cause is a missing capability check on an AJAX handler combined with a nonce that is issued to every visitor and therefore provides no authorization boundary; the published CVSS vector is network-reachable with low privileges and requires user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:R), and although the reporting source scored it 8.0, an independent assessment scores it considerably lower (S:C/C:L/I:L/A:N) because impact is confined to the victim's browser session within the site origin. Publicly available exploit code exists, but there is no confirmed active exploitation (CISA SSVC exploitation: none) and EPSS is low at 0.16% (4th percentile); a vendor patch is available in version 12.7.12.
SQL injection in the WordPress plugin WP Review Slider Pro (wp-review-slider-pro) before 12.7.12 allows any authenticated user - including a low-privileged Subscriber - to inject arbitrary SQL into a plugin AJAX handler and read data from the site's database; because the queried results are then rendered to unauthenticated visitors, the extracted data can be exposed publicly rather than being confined to the attacker's own session. Exploitation requires a valid account on the target site (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 6.5), which is trivial on sites that permit self-registration but blocked where registration is closed, and publicly available exploit code exists (no CISA KEV entry and no confirmed active exploitation; EPSS 0.16%, 5th percentile). Impact is confidentiality-only - no integrity or availability effect - but the leak-to-anonymous-visitors behavior makes this a genuine moderate-priority issue rather than a purely theoretical one.