Wp Review Slider Pro Vulnerabilities

The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'notinstring' parameter of the wprp_load_more_revs AJAX action in versions up to, and including, 12.7.2. The parameter is read via $_POST['notinstring'] and passed through sanitize_text_field() — which strips HTML and whitespace but do...

CVSS:

7.5

Affected:

up to 12.7.2

Fixed in:

12.7.3

Disclosed:

Jul 1, 2026

CVE-2026-8441 on NVD →

The WP Review Slider Pro plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to and including 12.6.8. This is due to missing authorization checks on the wpfb_hide_review and wprp_save_review_admin AJAX handlers combined with insufficient path validation in the wpfb_hidereview_ajax() function, w...

CVSS:

8.1

Affected:

up to 12.6.8

Fixed in:

12.7.0

Disclosed:

Jun 15, 2026

CVE-2026-8442 on NVD →

The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'curselrevs[]' parameter of the wpfb_find_reviews AJAX action in versions up to, and including, 12.6.8. This is due to the handler reading $_POST['curselrevs'] raw with no sanitization or type casting, then concatenating each array ele...

CVSS:

8.8

Affected:

up to 12.6.8

Fixed in:

12.7.0

Disclosed:

Jun 15, 2026

CVE-2026-8444 on NVD →

The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'stypes' and 'slocations' parameters of the wppro_get_overall_chart_data AJAX action in versions up to, and including, 12.6.8. This is due to the use of stripslashes() on user-supplied JSON strings prior to json_decode(), which removes...

CVSS:

8.8

Affected:

up to 12.6.8

Fixed in:

12.7.0

Disclosed:

Jun 15, 2026

CVE-2026-8443 on NVD →