What is the CVSS score of CVE-2026-4161?

CVE-2026-4161 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-4161?

Organizations using Review Map by RevuKangaroo should be aware of moderate risk from CVE-2026-4161, a cross-site scripting vulnerability rated CVSS 4.4.

How to fix or mitigate CVE-2026-4161?

Within 30 days: Identify affected systems running for WordPress is vulnerable to Stored Cross-Site Scripting v and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

WordPress CVE-2026-4161

EUVD-2026-14160 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-21 Wordfence

GHSA-6gc7-2mhh-r959

WordPress XSS

4.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.4 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-14160

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:27 nvd

MEDIUM 4.4

DescriptionCVE.org

The Review Map by RevuKangaroo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

AnalysisAI

The Review Map by RevuKangaroo WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability in its plugin settings that allows authenticated administrators to inject arbitrary JavaScript code through insufficient input sanitization and output escaping. This vulnerability affects all versions up to and including 1.7 and only manifests in WordPress multisite installations or single-site installations where the unfiltered_html capability has been disabled. Once injected, the malicious script executes whenever any user accesses the affected page, making this a persistent XSS attack vector that can compromise user sessions and sensitive data.

Technical ContextAI

The vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation), where the plugin fails to properly sanitize user inputs and escape output when storing and rendering plugin settings data. Based on the referenced code lines (233, 158, 162, 247, 253, 296 in the main plugin file), the issue appears to occur in the settings handling and output rendering functions within the Review Map by RevuKangaroo plugin (CPE: cpe:2.3:a:revukangaroo:review_map_by_revukangaroo:*:*:*:*:*:*:*:*). The vulnerability is technically exploitable because WordPress's unfiltered_html capability—which normally allows administrators to bypass HTML sanitization—is either disabled or not available in multisite configurations, meaning administrator inputs are processed through the content sanitization pipeline but not properly escaped when output to the DOM, leaving a gap where stored XSS can persist.

RemediationAI

Update the Review Map by RevuKangaroo plugin to a version newer than 1.7 that includes proper input sanitization and output escaping of plugin settings (check the WordPress plugin repository for the patched version release). Until the plugin is updated, WordPress administrators should restrict access to the plugin settings page to only the most trusted administrator accounts, implement role-based access controls to prevent lower-privileged administrators from modifying plugin settings, and monitor the WordPress admin audit logs for suspicious changes to Review Map settings. In multisite installations, network administrators should enforce security policies requiring all plugins to be kept current and consider temporarily disabling the Review Map by RevuKangaroo plugin on subsites until a patch is confirmed available. Additionally, implementing Web Application Firewalls (WAF) with XSS detection rules can provide a secondary layer of protection against the execution of injected scripts.