https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 22:26:07 +0000 https://cve.radiocsirt.org/vuln/cve-2026-8441 <p><strong>Affected:</strong> https://wpreviewslider.com/ WP Review Slider Pro</p> <p>The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the &#39;notinstring&#39; parameter of the wprp_load_more_revs AJAX action in versions up to, and including, 12.7.2. The parameter is read via $_POST[&#39;notinstring&#39;] and passed through sanitize_text_field() — which strips HTML and whitespace but does not provide SQL safety. The value is then concatenated directly into a numeric/unquoted `AND id NOT IN (...)` clause and executed via $wpdb-&gt;get_results() without $wpdb-&gt;prepare() or intval() casting. Because the value sits in an unquoted numeric context, WordPress&#39;s wp_magic_quotes protection (which only escapes embedded quotes) is ineffective. The AJAX hook is registered via wp_ajax_nopriv_wprp_load_more_revs, and the required check_ajax_referer nonce is publicly available via wp_localize_script on any frontend page that renders the plugin shortcode, so an unauthenticated attacker who can reach a public page hosting the plugin can extract arbitrary data from the database via blind/time-based injection.</p> <p><strong>Affected:</strong> https://wpreviewslider.com/ WP Review Slider Pro</p> <p>The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the &#39;notinstring&#39; parameter of the wprp_load_more_revs AJAX action in versions up to, and including, 12.7.2. The parameter is read via $_POST[&#39;notinstring&#39;] and passed through sanitize_text_field() — which strips HTML and whitespace but does not provide SQL safety. The value is then concatenated directly into a numeric/unquoted `AND id NOT IN (...)` clause and executed via $wpdb-&gt;get_results() without $wpdb-&gt;prepare() or intval() casting. Because the value sits in an unquoted numeric context, WordPress&#39;s wp_magic_quotes protection (which only escapes embedded quotes) is ineffective. The AJAX hook is registered via wp_ajax_nopriv_wprp_load_more_revs, and the required check_ajax_referer nonce is publicly available via wp_localize_script on any frontend page that renders the plugin shortcode, so an unauthenticated attacker who can reach a public page hosting the plugin can extract arbitrary data from the database via blind/time-based injection.</p> https://cve.radiocsirt.org/vuln/cve-2026-8441