The wp‑review‑slider‑pro WordPress plugin versions earlier than 12.7.12 fails to verify the user’s capability when handling the AJAX endpoint that saves review form submissions. The nonce used to protect the request is generated for every visitor, which means any authenticated user, including subscribers, can submit a crafted request. The submitted data is stored and later rendered on public pages without escaping, allowing an attacker to inject malicious script code. This stored cross‑site scripting can lead to session hijacking, defacement, or delivery of malware to site visitors, with no additional privileges required beyond authentication.

The vulnerability affects the WordPress plugin wp‑review‑slider‑pro versions prior to 12.7.12. Users running this plugin on any WordPress installation are susceptible. The specific vendor information is limited to the plugin identifier unknown:wp-review-slider-pro, and no official patch or version list is provided in the CNA data; therefore, all earlier releases are considered impacted.

The CVSS score is 8.0, but the scenario involves an AJAX endpoint accessible to authenticated users and an unescaped user‑generated payload, which represents a high‑impact attack. The EPSS score is < 1%, and the vulnerability is not listed in KEV. Attackers can exploit the flaw by simply logging in with any user account that has subscription permissions, then submitting a malicious review form. Because the flaw resides in the plugin code rather than the core WordPress software, the attack vector is content‑based and does not require network‑level access beyond the standard authentication flow.