Wp Airbnb Review Slider Vulnerabilities

[en] The WP Airbnb Review Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.2 due to insufficient URL validation that allows users to pull in a malicious HTML file. This makes it possible for authenticated attackers, with administrator-le...

Affected:

up to 4.4

Fixed in:

4.4

Disclosed:

Nov 7, 2025

CVE-2025-12520 on NVD →

The WP Airbnb Review Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.2 due to insufficient URL validation that allows users to pull in a malicious HTML file. This makes it possible for authenticated attackers, with administrator-level p...

CVSS:

4

Affected:

up to 4.2

Fixed in:

4.4

Disclosed:

Nov 6, 2025

CVE-2025-12520 on NVD →

[en] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in jgwhite33 WP Airbnb Review Slider allows Blind SQL Injection. This issue affects WP Airbnb Review Slider: from n/a through 3.9.

Affected:

up to 4.0

Fixed in:

4.0

Disclosed:

Feb 16, 2025

CVE-2025-26755 on NVD →

The WP Airbnb Review Slider plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 3.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level ac...

CVSS:

4.9

Affected:

up to 3.9

Fixed in:

4.0

Disclosed:

Feb 14, 2025

CVE-2025-26755 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in LJ Apps WP Airbnb Review Slider plugin <= 3.2 versions.

Affected:

up to 3.3

Fixed in:

3.3

Disclosed:

May 20, 2023

CVE-2023-23890 on NVD →

[en] The WP Airbnb Review Slider WordPress plugin before 3.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber.

Affected:

up to 3.3

Fixed in:

3.3

Disclosed:

Feb 13, 2023

CVE-2023-0262 on NVD →

The WP Airbnb Review Slider plugin for WordPress is vulnerable to SQL Injection via the $tid value in versions up to, and including, 3.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subsc...

CVSS:

8.8

Affected:

up to 3.2

Fixed in:

3.3

Disclosed:

Jan 23, 2023

CVE-2023-0262 on NVD →

The WP Airbnb Review Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2. This is due to missing or incorrect nonce validation when deleting user reviews. This makes it possible for unauthenticated attackers to delete user reviews, via forged request granted the...

CVSS:

4.3

Affected:

up to 3.2

Fixed in:

3.3

Disclosed:

Jan 20, 2023

CVE-2023-23890 on NVD →