CVE-2026-8444

The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'curselrevs[]' parameter of the wpfb_find_reviews AJAX action in versions up to, and including, 12.6.8. This is due to the handler reading $_POST['curselrevs'] raw with no sanitization or type casting, then concatenating each array element directly into a `WHERE id IN ( ... )` clause without quoting and executing via $wpdb->get_results() without $wpdb->prepare(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

• CWE-89

• https://wpreviewslider.com/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/633d26e9-8a05-4f4b-93a8-5644f2f699db?source=cve

Published

Jun 16, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-8434Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Requ…8.8
• CVE-2026-8435Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Requ…6.5
• CVE-2026-8438The All-In-One Security (AIOS) – Security and Firewall plugi…7.2
• CVE-2026-8441The WP Review Slider Pro plugin for WordPress is vulnerable …7.5
• CVE-2026-8442The WP Review Slider Pro plugin for WordPress is vulnerable …8.1
• CVE-2026-8443The WP Review Slider Pro plugin for WordPress is vulnerable …8.8
• CVE-2026-8446IBM Langflow OSS 1.0.0 through 1.10.3 contain an authenticat…7.5
• CVE-2026-8449Rejected reason: This CVE ID has been rejected or withdrawn.
• CVE-2026-8450HTTP::Daemon versions before 6.17 for Perl allow OS command …9.1
• CVE-2026-8451Insufficient input validation in NetScaler ADC and NetScaler…7.5
• CVE-2026-8452Memory overflow vulnerability NetScaler ADC and NetScaler Ga…9.8
• CVE-2026-8453Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…