CVE-2026-84095 is a stored Cross-Site Scripting (XSS) vulnerability in the wp-review-slider-pro WordPress plugin versions prior to 12.7.12. The vulnerability arises from the lack of capability checks on an AJAX handler combined with a nonce that is generated for every visitor, allowing any authenticated user to inject arbitrary review content. This malicious content is then rendered on public pages without escaping, enabling stored XSS attacks.

An attacker with any authenticated user privileges, such as a subscriber, can inject malicious scripts into review content. These scripts are stored and later executed in the browsers of users viewing the affected public pages, potentially leading to session hijacking, defacement, or other client-side attacks. There is no indication of active exploitation in the wild.

Upgrade the wp-review-slider-pro plugin to version 12.7.12 or later, where this vulnerability is fixed. Since the vulnerability is resolved in this version, no additional mitigation steps are necessary.