CVE-2026-93778: WP Yelp Review Slider XSS Vulnerability

CVE-2026-93778 Overview

The WP Yelp Review Slider plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in all versions up to and including 9.2. The flaw exists in how the plugin handles Yelp review text imported through the wpyelp_download_source function. Insufficient input sanitization and output escaping allow arbitrary web scripts to be stored in the WordPress database and executed when visitors load affected pages. Because the malicious payload originates from an anonymous Yelp reviewer on a public platform and enters the database during the site administrator's normal use of the Download Reviews feature, the effective attacker is unauthenticated and requires no WordPress account.

Critical Impact
Unauthenticated attackers can inject persistent JavaScript into WordPress pages, enabling session hijacking, credential theft, and administrator account takeover through the plugin's review import workflow.

Affected Products

WP Yelp Review Slider plugin for WordPress, all versions up to and including 9.2
WordPress sites using the plugin's Download Reviews feature
Public-facing pages rendering imported Yelp reviews via template_style_1.php

Discovery Timeline

2026-09-22 - CVE-2026-93778 published to the National Vulnerability Database (NVD)
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-93778

Vulnerability Analysis

The vulnerability is a Stored Cross-Site Scripting flaw classified under [CWE-79]. The plugin retrieves reviews from Yelp via the wpyelp_download_source import path in class-wp-yelp-review-slider-admin.php and persists the reviewer-supplied text to the WordPress database without adequate sanitization. When the plugin later renders those reviews through template_style_1.php, the review text is emitted into the page without proper output escaping. Any script content embedded in a Yelp review executes in the browser context of every visitor who loads the injected page.

Because the scope changes from the vulnerable component to the affected browser, the impact reaches users beyond the plugin itself. Successful exploitation can lead to session token theft, forced administrative actions through the victim's browser, redirection to attacker-controlled hosts, and injection of secondary payloads.

Root Cause

The root cause is missing input sanitization at import time and missing output escaping at render time. The plugin trusts data supplied by a remote third-party source (Yelp) and passes reviewer-authored text through to storage and display without applying WordPress functions such as wp_kses_post, esc_html, or esc_attr. See the WordPress Plugin Code Snippet at line 1140 and the template rendering at line 95 for the affected code paths.

Attack Vector

The attack requires no authentication on the target WordPress site. An attacker posts a Yelp review containing a JavaScript payload under a business profile that a targeted WordPress administrator imports. When the administrator uses the Download Reviews feature, the plugin fetches and stores the malicious review. The payload then executes each time a visitor or authenticated administrator loads a page containing the affected review slider. Full technical details are available in the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-93778

Indicators of Compromise

Presence of <script>, onerror=, onload=, or JavaScript URI schemes inside stored Yelp review records in the WordPress database.
Unexpected outbound requests from visitor browsers to unknown domains when loading pages that embed the review slider.
Newly created WordPress administrator accounts or modified user roles following administrator visits to review-slider pages.
Anomalous session activity or cookie exfiltration originating from pages that render the plugin's output.

Detection Strategies

Query the wp_posts and wp_postmeta tables for review content matching HTML tag patterns or JavaScript event handlers.
Inspect rendered HTML from pages using the WP Yelp Review Slider shortcode for script tags that were not authored by site administrators.
Monitor web server access logs for requests to pages hosting the plugin followed by unusual redirects or third-party script loads.

Monitoring Recommendations

Enable a Content Security Policy (CSP) that blocks inline scripts and reports violations to a centralized logging endpoint.
Alert on file integrity changes to wp-yelp-review-slider plugin directories and on new administrator role assignments.
Forward WordPress audit logs to a centralized SIEM or data lake for correlation with browser-side violation reports.

How to Mitigate CVE-2026-93778

Immediate Actions Required

Deactivate the WP Yelp Review Slider plugin until a patched version above 9.2 is installed and verified.
Audit all stored Yelp reviews in the WordPress database and remove any records containing HTML or script content.
Rotate WordPress administrator passwords and invalidate active sessions if the plugin has been in use with imported reviews.

Patch Information

Review the vendor's WordPress Plugin Changeset for the code changes addressing this issue. Site administrators should update to a version of WP Yelp Review Slider newer than 9.2 that incorporates sanitization on the wpyelp_download_source import path and output escaping in template_style_1.php. Confirm the installed version through the WordPress admin plugins page after updating.

Workarounds

Disable the plugin's Download Reviews feature and avoid importing new reviews until the update is applied.
Deploy a web application firewall (WAF) rule to strip or block script tags in HTTP responses from pages using the plugin shortcode.
Apply a strict Content Security Policy that disallows inline JavaScript on pages rendering third-party review content.
Restrict administrator access to review-slider pages using role-based access controls or IP allowlists during triage.

bash

# Configuration example: temporarily deactivate the plugin via WP-CLI
wp plugin deactivate wp-yelp-review-slider

# Search the database for suspicious script content in review data
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%<script%' OR post_content LIKE '%onerror=%';"

# Update the plugin once a fixed version is available
wp plugin update wp-yelp-review-slider