Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Not this one?WordPress Review Plugin: The Ultimate Solution for Building a Review WebsiteWidgets for Google Reviewswp-review-slider-pro
Plugin · wp-review-slider-pro
wp-review-slider-pro
3 known vulnerabilities on record. Add your version above to see which ones affect you.
Sep 26, 2026wp-review-slider-pro: Does not sanitize a value stored through one of its AJAX handlersCVE-2026-84097 · fixed in 12.7.12 · reported by WPScanMedium 6.5
The wp-review-slider-pro WordPress plugin before 12.7.12 does not sanitize a value stored through one of its AJAX handlers, which lacks a capability check, before using it in a SQL statement, allowing any authenticated user, such as a subscriber, to perform SQL injection attacks whose results are then returned to unauthenticated visitors.
Sep 26, 2026wp-review-slider-pro: Does not perform a capability check on the AJAX handler that saves its review submission formsCVE-2026-84096 · fixed in 12.7.12 · reported by WPScanHigh 8
The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capability check on the AJAX handler that saves its review submission forms, and the nonce protecting it is generated for every visitor, allowing any authenticated user, such as a subscriber, to overwrite a live form with field values that are output without escaping on public pages, leading to Stored Cross-Site Scripting.
Sep 26, 2026wp-review-slider-pro: Does not perform a capability check on one of its AJAX handlersCVE-2026-84095 · fixed in 12.7.12 · reported by WPScanHigh 8
The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capability check on one of its AJAX handlers, and the nonce protecting it is generated for every visitor, allowing any authenticated user, such as a subscriber, to store arbitrary review content which is later output without escaping on public pages, leading to Stored Cross-Site Scripting.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.