CVE-2026-84096 is a stored cross-site scripting vulnerability in the wp-review-slider-pro WordPress plugin prior to version 12.7.12. The flaw arises from missing capability checks on the AJAX handler that processes review submission forms and the use of a nonce that is generated for every visitor, which does not effectively restrict access. This allows any authenticated user, such as a subscriber, to inject malicious scripts by overwriting live form data that is rendered without escaping on public-facing pages.

An attacker with any authenticated user account, including low-privileged roles, can inject malicious JavaScript code into review submission forms. This code is stored and subsequently executed in the browsers of users who view the affected pages, potentially leading to session hijacking, defacement, or other client-side attacks.

Upgrade the wp-review-slider-pro plugin to version 12.7.12 or later, where this vulnerability is fixed. The vendor advisory or patch links are not provided in the input, but the version boundary indicates that versions before 12.7.12 are affected and the issue is resolved in 12.7.12. Until upgraded, restrict authenticated user roles that can submit reviews or disable the plugin if possible.