The wp-review-slider-pro WordPress plugin for versions before 12.7.12 fails to check user capabilities on an AJAX endpoint and uses a visitor‑specific nonce, which allows any authenticated user, even a subscriber, to submit arbitrary review content. This content is then output on public pages without escaping, creating a stored cross‑site scripting vulnerability. The consequence is that an attacker can inject and persist malicious JavaScript that will run in the browsers of any site visitor, potentially leading to defacement, credential theft, or further exploitation of the site or its users.

All installations of the wp-review-slider-pro plugin older than version 12.7.12 are affected, regardless of WordPress core version or other plugins. The vulnerability is specific to the review import functionality exposed via AJAX and does not require other components of the plugin to be vulnerable.

The flaw permits exploitation by any authenticated user with subscriber privileges, meaning the barrier to attack is low and does not require complex credentials or network access. Because the malicious payload is stored and delivered to visitors unobstructed, the impact on end‑user confidentiality and integrity is high. The CVSS score of 8.0 reflects a high severity, and the EPSS score is < 1%, indicating a low but non‑zero probability of exploitation. The vulnerability is not yet listed in the CISA KEV catalog, but the ability for an attacker to execute arbitrary JavaScript on user browsers suggests a high‑severity risk. The lack of a correct capability check and proper output escaping facilitates straightforward exploitation once the plugin is activated on a site.