WordPress security by component
WP TripAdvisor Review Slider
WP TripAdvisor Review Slider (wp-tripadvisor-review-slider) is a WordPress plugin with 6 published CVE records in this archive. The latest tracked vulnerability was published Aug 05, 2026; the highest published CVSS base score is 8.8.
Plugin slug:
wp-tripadvisor-review-sliderLatest vulnerability
CVE-2026-11969: WP TripAdvisor Review Slider curselrevs permits administrator SQL injection
WP TripAdvisor Review Slider through 14.3 places attacker-controlled curselrevs[] values into an inadequately prepared SQL query without sufficient escaping. An Administrator can append SQL capable of extracting sensitive database information. This 4.9-scored record received deeper review because the primitive is SQL injection. The CNA does not disclose the administration page, action, handler or exact SQL sink.
| Safe version |
|
||
|---|---|---|---|
| Aug 05, 2026 |
CVE-2026-11969
WP TripAdvisor Review Slider curselrevs permits administrator SQL injection
WP TripAdvisor Review Slider through 14.3 places attacker-controlled curselrevs[] values into an inadequately prepared SQL query without sufficient escaping. An Administrator can append SQL capable of extracting sensitive database information. This 4.9-scored record received deeper review because the primitive is SQL injection. The CNA does not disclose the administration page, action, handler or exact SQL sink.
|
14.4 |
CVE4.9
NVDPending
|
| Jul 16, 2026 |
CVE-2026-15651
WP TripAdvisor Review Slider filters allow SQL injection
WP TripAdvisor Review Slider 14.6 and earlier interpolates the filtersource parameter into a database query without adequate escaping or prepared statements. An authenticated administrator can append SQL and read sensitive database content.
|
See mitigation notes |
CVE4.9
NVDPending
|
| Mar 25, 2026 |
CVE-2026-32490
WP TripAdvisor Review Slider: Cross-site scripting
WP TripAdvisor Review Slider is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is n/a through <= 14.1. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.
|
14.2 |
CVE6.5
NVDPending
|
| Jun 03, 2024 |
CVE-2024-35630
WP TripAdvisor Review Slider: SQL injection
WP TripAdvisor Review Slider is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.
|
See mitigation notes |
CVE7.6
NVDPending
|
| Jan 01, 2024 |
CVE-2023-6037
WP TripAdvisor Review Slider: Cross-site scripting
WP TripAdvisor Review Slider is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.
|
See mitigation notes |
CVE4.8
NVD4.8
|
| Feb 13, 2023 |
CVE-2023-0261
WP TripAdvisor Review Slider: SQL injection
WP TripAdvisor Review Slider is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.
|
See mitigation notes |
CVE8.8
NVD8.8
|