We’re actively acquiring WordPress agencies. Sell your WordPress business to Freshy.
Let’s discuss

WP Yelp Review Slider Plugin Vulnerability (CVE-2026-93778)

Nick Paliughi
On this page

Security Alert Summary

The WP Yelp Review Slider plugin for WordPress is affected by a stored cross-site scripting (XSS) vulnerability in its handling of Yelp review text. An attacker can inject malicious script content via an anonymous Yelp reviewer; the payload is stored in the site database during the plugin’s Download Reviews feature and will execute when a user views the affected page. No WordPress account is required for the attacker to introduce the payload.

CVE Details

  • CVE ID: CVE-2026-93778
  • Affected component: WP Yelp Review Slider plugin for WordPress
  • Affected versions: All versions up to and including 9.2
  • Published: September 22, 2026 at 8:16:42 AM UTC
  • Last modified: September 22, 2026 at 11:17:26 AM UTC
  • CVSS v3.1: Base score 7.2, severity HIGH, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
  • Authentication / privileges / user interaction: No authentication required; privileges required: none; user interaction: none
  • Primary impact: Confidentiality: Low; Integrity: Low; Availability: None
  • Weakness: CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-site Scripting)

Technical Details

The vulnerability is a stored cross-site scripting issue in the plugin’s processing of Yelp review text imported via wpyelp_download_source. Insufficient input sanitization and output escaping allow an attacker-controlled review text to be saved into the site’s database when an administrator uses the plugin’s Download Reviews feature. The malicious payload originates from an anonymous Yelp reviewer on a public platform and requires no WordPress account to be introduced.

When a page that displays the stored review is rendered, the injected script can execute in the context of any visitor viewing that page. The CVE description identifies the import mechanism (wpyelp_download_source) and the Download Reviews workflow as the vector for introducing the stored content.

How This Could Impact Your Website

In a realistic scenario, a site owner or administrator uses the plugin to import reviews. An anonymous Yelp reviewer can include script content in their public review, which gets pulled into the site database during the normal Download Reviews operation. Internal staff or external contractors who view pages that render the imported review could have that script executed in their browsers. Practical consequences include exposure of internal user information visible on rendered pages and an increased risk of targeted phishing or social engineering attacks against staff members whose browsers execute the malicious script.

If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review of your setup.

Recommended Actions

  • Update the affected plugin as soon as a patched version is available.
  • Review and reduce unnecessary user roles, especially contributor-level accounts.
  • Enforce strong passwords and two-factor authentication for editors and administrators.
  • Remove unused or unmaintained plugins from your site.
  • Monitor site activity and logs for unusual behavior or unexpected content in imported reviews.

If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.

References

Nick Paliughihttps://freshysites.com/team/nick-paliughi/
Nick was born in California and now resides in Lake Worth, FL. He has 10 years of experience building and maintaining sites in WordPress, which he is excited to put to use at Freshy. Prior to starting at Freshy in 2022 his focus was on WordPress security & malware removal. When he’s not tending to your website, Nick is installing exhibitions at art galleries and museums in Palm Beach County, and if he’s lucky surfing at the Lake Worth pier.

See our featured website design work

Check out some of the beautiful websites we’ve built for over 2,000 clients.

View projects

We offer WordPress support & maintenance

Shake the stress of ongoing maintenance with plans supported by our team of WordPress experts.

Learn more
Previous Post
ThumbPress Plugin Vulnerability (CVE-2026-7622)
Next Post
Tutor LMS – eLearning and online course solution Plugin Vulnerability (CVE-2026-18439)