CVE-2026-93778 is a stored Cross-Site Scripting vulnerability in the WP Yelp Review Slider plugin for WordPress, affecting all versions up to and including 9.2. The vulnerability arises from insufficient input sanitization and output escaping of Yelp review text imported via the wpyelp_download_source function. An unauthenticated attacker can inject arbitrary web scripts into the database during normal plugin use by the site administrator, which then execute in the context of users viewing the injected pages. The malicious payload is sourced from anonymous Yelp reviewers on a public platform, making exploitation possible without authentication.

Successful exploitation can lead to execution of arbitrary scripts in users' browsers when they access pages containing the injected Yelp reviews. This can result in information disclosure, session hijacking, or other client-side impacts. The vulnerability has a CVSS 3.1 score of 7.2 (High), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality and integrity with no availability impact.

No official patch or fix is currently documented. Administrators should monitor the vendor's advisory channels for updates. Until a fix is available, consider disabling the plugin or avoiding use of the Download Reviews feature to prevent injection of malicious Yelp review content. Implementing manual input validation or output escaping may reduce risk but is not a substitute for an official fix. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.