The WP Review Slider Pro plugin contains an SQL Injection flaw in the 'stypes' and 'slocations' parameters of the wppro_get_overall_chart_data AJAX action. The code removes JSON escaping through stripslashes() before decoding, then inserts unvalidated data directly into SQL WHERE clauses. This allows an authenticated user with Subscriber privilege or higher to inject additional SQL statements and extract sensitive database content. The handler also echoes the constructed SQL in its JSON response, simplifying blind exploitation and increasing the risk of data leakage.

WP Review Slider Pro for WordPress, all releases up to and including version 12.6.8 are affected. No other vendors or products are listed.

The vulnerability has a CVSS score of 8.8, indicating high severity, but the EPSS score is below 1%, meaning exploit attempts are currently rare. It is not listed in CISA’s KEV catalog. The attack vector is inferred to be an authenticated AJAX request, requiring at least Subscriber‑level access. While the high CVSS reflects significant confidentiality risk, the low EPSS suggests limited real‑world exploitation at this time.