Medium severity6.5NVD Advisory· Published Sep 26, 2026· Updated Sep 28, 2026
CVE-2026-84097
CVE-2026-84097
Description
The wp-review-slider-pro WordPress plugin before 12.7.12 does not sanitize a value stored through one of its AJAX handlers, which lacks a capability check, before using it in a SQL statement, allowing any authenticated user, such as a subscriber, to perform SQL injection attacks whose results are then returned to unauthenticated visitors.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <12.7.12
Patches
Vulnerability mechanics
References
1News mentions
1- Wordfence Intelligence Weekly WordPress Vulnerability Report (September 21, 2026 to September 27, 2026)Wordfence Blog · Oct 1, 2026