Description

The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capability check on one of its AJAX handlers, and the nonce protecting it is generated for every visitor, allowing any authenticated user, such as a subscriber, to store arbitrary review content which is later output without escaping on public pages, leading to Stored Cross-Site Scripting.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.0",
  "pubDate": "2026-09-26T07:17:02.520Z",
  "pubdate": "2026-09-26T07:17:02.520Z",
  "executiveSummary": "The wp-review-slider-pro WordPress plugin before version 12.7.12 contains a critical vulnerability involving improper access control and insufficient input sanitization.\nThe vulnerability is classified as Stored Cross-Site Scripting (XSS), which allows an authenticated user, including those with minimal privileges such as a subscriber, to inject arbitrary malicious scripts into the application.\nThis flaw arises because the plugin fails to implement a server-side capability check on a specific AJAX handler, and the associated security nonce is insufficiently protected as it is generated for every site visitor.\nSuccessful exploitation permits an attacker to store malicious payloads within review content. Once stored, this payload executes in the browsers of users—including administrators—viewing public pages where these reviews are rendered.\nThe impact includes potential account takeover, unauthorized administrative actions, and session hijacking. Because the payload is stored persistently, the risk persists until the malicious entry is removed or the plugin is updated to version 12.7.12 or later.",
  "technicalDetails": "The vulnerability is primarily rooted in an insecure AJAX handler within the wp-review-slider-pro plugin. The implementation lacks an authoritative 'current_user_can()' check, meaning the backend does not verify if the requester possesses the necessary administrative privileges before executing the requested logic.\nCompounding this access control failure is the implementation of the nonce verification mechanism. The plugin generates a nonce for every visitor, effectively neutralizing the intended role of the nonce as an anti-CSRF token against authenticated users. Because the nonce is predictable or accessible to any visitor, it provides no real barrier to malicious requests.\nAn attacker with subscriber-level access can craft an HTTP POST request to the vulnerable AJAX endpoint. By including a crafted payload within the request parameters—specifically targeting the fields intended for review content—the attacker can bypass authorization constraints.\nThe application accepts this input and persists it directly into the WordPress database without applying appropriate sanitization or filtering functions, such as 'sanitize_text_field()' or 'wp_kses_post()'.\nUpon rendering these reviews on public-facing pages, the plugin fails to perform output encoding. Consequently, the browser interprets the stored payload as active HTML or JavaScript content. If an administrator visits a page containing the injected review, the script executes within the context of the administrator's authenticated session.\nThis allows for post-exploitation activities such as exfiltrating sensitive session cookies, performing unauthorized configuration changes via the WP REST API, or injecting further malicious content into the site's ecosystem. The exploitation flow follows a logical progression: 1) Enumerating the AJAX endpoint, 2) Acquiring a valid nonce for the current session, 3) Submitting a forged request containing the XSS payload, 4) Persistent storage of the payload in the database, and 5) Execution of the payload upon client-side rendering by the victim's browser."
}