Description

The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capability check on the AJAX handler that saves its review submission forms, and the nonce protecting it is generated for every visitor, allowing any authenticated user, such as a subscriber, to overwrite a live form with field values that are output without escaping on public pages, leading to Stored Cross-Site Scripting.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.0",
  "pubDate": "2026-09-26T07:17:02.623Z",
  "pubdate": "2026-09-26T07:17:02.623Z",
  "executiveSummary": "The wp-review-slider-pro WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) due to a flaw in its AJAX request handling mechanism. The vulnerability exists because the plugin fails to implement proper capability checks on the AJAX handler responsible for saving review submission forms.\nFurthermore, the nonce generated for these forms is accessible to all visitors, including unprivileged users. This allows an authenticated attacker, such as a user with the subscriber role, to interact with the administrative submission endpoint.\nBy manipulating the request parameters, an attacker can overwrite existing review forms with malicious data. When this data is rendered on the public-facing pages of the website, the lack of output escaping triggers the execution of arbitrary JavaScript in the context of the victim's browser session.\nThis vulnerability poses a significant risk to site integrity and user security, potentially leading to session hijacking, credential theft, or unauthorized actions performed on behalf of site administrators. The flaw affects all versions of the wp-review-slider-pro plugin prior to 12.7.12. Remediation requires an immediate update to the latest patched version to enforce correct authorization and output sanitization.",
  "technicalDetails": "The root cause of this vulnerability lies in an insufficient access control implementation within the AJAX handler responsible for processing and storing review form submissions in wp-review-slider-pro. In the vulnerable versions prior to 12.7.12, the plugin fails to verify the administrative capabilities of the user invoking the save action. Consequently, any authenticated user—regardless of their assigned role or permission level—is permitted to execute the backend function.\nA secondary, but critical, factor facilitating this exploit is the predictable nature of the nonce protection. The plugin generates a nonce for the submission form that is available to all visitors to the site. Because the nonce is not restricted to administrative sessions and the server-side code lacks a secondary capability check (e.g., current_user_can('manage_options')), the nonce does not provide actual security against unauthorized submissions.\nThe attack flow proceeds as follows: First, an attacker logs into the WordPress site using a low-privileged account, such as a subscriber. Second, the attacker retrieves a valid nonce by visiting a public page where the review form is rendered. Third, the attacker crafts a malicious POST request to the WordPress admin-ajax.php endpoint, targeting the specific plugin handler. This payload includes modified field values containing malicious JavaScript, designed to be stored in the plugin's review database table.\nUpon successful submission, the malicious script is persisted in the database. When a visitor, including an administrator, navigates to the public page where the review slider is displayed, the plugin fetches the stored data and reflects the contents directly into the HTML document object model (DOM) without applying necessary output escaping or sanitization functions such as esc_html() or wp_kses_post().\nThe browser interprets the reflected payload as executable JavaScript code, resulting in Stored XSS. This allows the attacker to execute arbitrary scripts within the context of the user's session. The impact of this exploit includes the ability to perform unauthorized administrative actions, capture session cookies, exfiltrate sensitive site data, or perform phishing attacks against legitimate users viewing the compromised review content."
}