https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 07:04:35 +0000 https://cve.radiocsirt.org/vuln/cve-2026-8444 <p><strong>Affected:</strong> https://wpreviewslider.com/ WP Review Slider Pro</p> <p>The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the &#39;curselrevs[]&#39; parameter of the wpfb_find_reviews AJAX action in versions up to, and including, 12.6.8. This is due to the handler reading $_POST[&#39;curselrevs&#39;] raw with no sanitization or type casting, then concatenating each array element directly into a `WHERE id IN ( ... )` clause without quoting and executing via $wpdb-&gt;get_results() without $wpdb-&gt;prepare(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.</p> <p><strong>Affected:</strong> https://wpreviewslider.com/ WP Review Slider Pro</p> <p>The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the &#39;curselrevs[]&#39; parameter of the wpfb_find_reviews AJAX action in versions up to, and including, 12.6.8. This is due to the handler reading $_POST[&#39;curselrevs&#39;] raw with no sanitization or type casting, then concatenating each array element directly into a `WHERE id IN ( ... )` clause without quoting and executing via $wpdb-&gt;get_results() without $wpdb-&gt;prepare(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.</p> https://cve.radiocsirt.org/vuln/cve-2026-8444