WordPress Review Slider Pro Stored XSS via Unauthenticated AJAX

The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capability check on one of its AJAX handlers, and the nonce protecting it is generated for every visitor, allowing any authenticated user, such as a subscriber, to store arbitrary review content which is later output without escaping on public pages, leading to Stored Cross-Site Scripting.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The wp-review-slider-pro WordPress plugin contains a critical stored cross-site scripting (XSS) vulnerability that allows low-privileged users to inject malicious code into review content. The flaw stems from two security oversights: the vulnerable AJAX handler lacks proper capability checks, and its protective nonce is generated for every visitor rather than being user-specific, effectively neutralizing its security purpose. This means any authenticated user—even subscribers with minimal permissions—can inject arbitrary JavaScript that persists in the database and executes whenever the review is displayed on public pages. WordPress site administrators and their users are at immediate risk, particularly on sites hosting sensitive content or conducting e-commerce, as attackers can harvest credentials, deface pages, or redirect visitors to malicious sites.

Casky's 323 matched skills leverage Claude AI's extended reasoning to identify this attack chain across MITRE ATT&CK's Initial Access (TA0001) and Execution (TA0043) tactics. Practitioners would observe detection patterns revealing: (1) anomalous AJAX requests to the review-slider endpoint from low-privilege user accounts, (2) payloads containing script tags or event handlers in POST parameters, (3) CWE-79 signatures detecting unescaped output in the wp_kses_post() or similar sanitization failures, and (4) database queries storing unsanitized input in the reviews table. Casky's skill mapping would flag the capability check absence and nonce validation bypass as authentication evasion techniques, surfacing these findings with correlated IOCs and recommended patch timelines for affected WordPress instances.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-84095.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-84095

Casky has 323 skills that investigate the attack patterns behind CVE-2026-84095. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn