Executive brief
The WP Yelp Review Slider plugin for WordPress allows attackers to inject malicious scripts into pages through Yelp review text. When a site administrator uses the plugin's Download Reviews feature, scripts from Yelp reviews are stored in the database without proper sanitization. Any visitor to the affected pages will unknowingly execute these scripts, potentially leading to account takeover, credential theft, or malware distribution.
Technical details
A stored XSS vulnerability exists in the wpyelp_download_source functionality due to insufficient input sanitization and output escaping of Yelp review text. The vulnerability is triggered when an administrator imports reviews via the Download Reviews feature; malicious payloads injected by anonymous Yelp reviewers are stored unescaped in the database and rendered without proper encoding. No authentication is required since the attacker controls the source data on Yelp's public platform.
Affected products
- WordPress.org WP Yelp Review Slider up to 9.2
Timeline
- 2026-09-22: disclosed