CyberRota Analysis
AI-GeneratedThe wp-review-slider-pro plugin for WordPress versions prior to 12.7.12 is vulnerable due to a lack of capability checks on an AJAX handler, allowing any authenticated user, including subscribers, to inject arbitrary review content. This content is subsequently displayed on public pages without proper escaping, resulting in a Stored Cross-Site Scripting (XSS) vulnerability. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate potential exploitation risks.
Original NVD Description
The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capability check on one of its AJAX handlers, and the nonce protecting it is generated for every visitor, allowing any authenticated user, such as a subscriber, to store arbitrary review content which is later output without escaping on public pages, leading to Stored Cross-Site Scripting.