CVE-2026-84097: Unknown Wp-Review-Slider-Pro

Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days.

The wp-review-slider-pro WordPress plugin before 12.7.12 does not sanitize a value stored through one of its AJAX handlers, which lacks a capability check, before using it in a SQL statement, allowing any authenticated user, such as a subscriber, to perform SQL injection attacks whose results are then returned to unauthenticated visitors.

Affected products

• Unknown Wp-Review-Slider-Pro: before 12.7.12 (fixed in 12.7.12)

Published 2026-09-26. Last modified 2026-09-28.