Vulnerabilities and security researches forwp-yelp-review-slider wp-yelp-review-slider

Jun 06, 2024

CVE, Research URL: CVE-2023-0263
Home page URL: Security reports for WP Yelp Review Slider
Application: WP Yelp Review Slider
Date: Feb 13, 2023
Research Description: The WP Yelp Review Slider WordPress plugin before 7.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber.
Affected versions: max 7.1.
Status: vulnerable

Feb 27, 2025

CVE, Research URL: CVE-2025-26946
Home page URL: Security reports for WP Yelp Review Slider
Application: WP Yelp Review Slider
Date: Feb 25, 2025
Research Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in jgwhite33 WP Yelp Review Slider wp-yelp-review-slider allows Blind SQL Injection.This issue affects WP Yelp Review Slider: from n/a through <= 8.1.
Affected versions: max 8.2.
Status: vulnerable

Sep 23, 2026

CVE, Research URL: CVE-2026-93778
Home page URL: Security reports for WP Yelp Review Slider
Application: WP Yelp Review Slider
Date: Sep 22, 2026
Research Description: The WP Yelp Review Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Yelp Review Text (imported via wpyelp_download_source) in all versions up to, and including, 9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The malicious payload originates from an anonymous Yelp reviewer on a public platform and requires no WordPress account; it is introduced into the database during the site administrator's ordinary use of the plugin's Download Reviews feature, making the effective attacker unauthenticated.
Affected versions: max 9.3.
Status: vulnerable