WP Review Slider Pro

WP Review Slider Pro has 7 disclosed vulnerabilities in the WordSec catalog, all reported in 2026; all 7 are fixed as of October 2026. Their average CVSS score is 7.5, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 4 high. 2026 was the busiest year with 7 disclosures.

The most common weakness is SQL Injection, behind 4 of the records (57%). Other recurring categories include Cross-Site Scripting, Path Traversal.

Every one of the 7 issues recorded for WP Review Slider Pro has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, most of them (4) reported by h0xilo.

Strategic Overview

Avg CVSSHigh

7.5/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all WP Review Slider Pro vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8CVE-2026-8444

WP Review Slider Pro <= 12.6.8 - Authenticated (Subscriber+) SQL Injection via 'curselrevs' Parameter

Read the full analysis

Vulnerability Records

7 records


2026-09-24 00:00	Review Slider Pro <= 12.7.11 - Authenticated (Subscriber+) Stored Cross-Site Scripting WP Review Slider Pro <= 12.7.11	`CVE-2026-84096`	6.4 Medium	Erwan LR	Yes
2026-09-24 00:00	Review Slider Pro <= 12.7.11 - Authenticated (Subscriber+) Stored Cross-Site Scripting WP Review Slider Pro <= 12.7.11	`CVE-2026-84095`	6.4 Medium	Erwan LR	Yes
2026-09-24 00:00	Review Slider Pro <= 12.7.11 - Authenticated (Subscriber+) SQL Injection WP Review Slider Pro <= 12.7.11	`CVE-2026-84097`	6.5 Medium	Erwan LR	Yes
2026-07-01 21:02	WP Review Slider Pro <= 12.7.2 - Unauthenticated SQL Injection via 'notinstring' Parameter WP Review Slider Pro <= 12.7.2	`CVE-2026-8441`	7.5 High	h0xilo	Yes
2026-06-15 20:44	WP Review Slider Pro <= 12.6.8 - Authenticated (Subscriber+) Arbitrary File Deletion via 'myaction' Parameter WP Review Slider Pro <= 12.6.8	`CVE-2026-8442`	8.1 High	h0xilo	Yes
2026-06-15 18:29	WP Review Slider Pro <= 12.6.8 - Authenticated (Subscriber+) SQL Injection via 'curselrevs' Parameter WP Review Slider Pro <= 12.6.8	`CVE-2026-8444`	8.8 High	h0xilo	Yes
2026-06-15 17:04	WP Review Slider Pro <= 12.6.8 - Authenticated (Subscriber+) SQL Injection via 'stypes' Parameter WP Review Slider Pro <= 12.6.8	`CVE-2026-8443`	8.8 High	h0xilo	Yes

Showing 1–7 of 7 reports