Unauthenticated Form Manipulation Leads to Stored XSS

The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capability check on the AJAX handler that saves its review submission forms, and the nonce protecting it is generated for every visitor, allowing any authenticated user, such as a subscriber, to overwrite a live form with field values that are output without escaping on public pages, leading to Stored Cross-Site Scripting.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The wp-review-slider-pro WordPress plugin before version 12.7.12 contains a critical Stored Cross-Site Scripting (CWE-79) vulnerability in its AJAX form handler. Despite generating nonces for every visitor, the handler fails to validate user capabilities, allowing any authenticated user—even those with minimal permissions like subscribers—to modify live review submission forms. The injected malicious payloads are then rendered without proper output escaping on public-facing pages, creating a persistent XSS condition that affects all site visitors. This vulnerability threatens WordPress installations relying on this plugin, as attackers can inject arbitrary JavaScript to steal session tokens, redirect users, harvest credentials, or perform account takeovers at scale.

Casky's 323 matching skills leverage Claude's extended reasoning to correlate this vulnerability against MITRE ATT&CK techniques TA0001 (Initial Access) and TA0043 (Reconnaissance). Practitioners using Casky would observe detections flagging: improper input validation patterns in AJAX handlers, insufficient capability checks preceding privileged operations, nonce generation without accompanying permission verification, and unescaped output rendering user-controlled data. The platform's skill mapping would highlight how attackers exploit Initial Access by compromising subscriber accounts, then escalate through Reconnaissance activities to identify target forms before injecting payloads. Real-time analysis would surface suspicious AJAX requests modifying form configurations, coupled with DOM manipulation indicators suggesting XSS payload execution in subsequent page requests.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-84096.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-84096

Casky has 323 skills that investigate the attack patterns behind CVE-2026-84096. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn