JetReviews CVE-2026-57354

Exploitation requires the attacker to hold a subscriber-level (or higher) WordPress account on the target site, meaning open user registration must be enabled or the attacker must have obtained credentials by other means. The victim (typically a WordPress administrator or editor) must navigate to a page or admin view that renders the malicious review content, satisfying the UI:R requirement. The plugin must be installed and active. Sites with open registration and unmoderated review workflows face the highest exposure. Exploitation is limited by: the need for an authenticated subscriber account (PR:L, not unauthenticated), the requirement for a privileged user to view the injected content (UI:R), and the plugin being actively installed and in use.

The CVSS 3.1 score of 6.5 (Medium) is driven by PR:L (requires subscriber account), UI:R (victim must view the page), and S:C (scope changes). Real-world risk is moderate-to-elevated for sites that allow open user registration: any registered user can plant a persistent payload targeting administrators. No EPSS data was provided in the intelligence, so probabilistic exploitation likelihood cannot be precisely quantified. The vulnerability is not listed in CISA KEV, and no POC code has been identified, which reduces urgency compared to actively exploited XSS issues. However, stored XSS with subscriber-accessible injection on WordPress sites that permit public registration carries a meaningful privilege escalation path - a subscriber executing JavaScript in an admin's browser can create rogue admin accounts, install malicious plugins, or exfiltrate authentication nonces. The low attack complexity (AC:L) means no special race conditions or prerequisite state is needed beyond a valid subscriber session.

An attacker registers a free subscriber account on a WordPress site running JetReviews <= 3.0.0.1 and submits a review containing a crafted JavaScript payload - for example, a script that silently creates a new administrator account or exfiltrates the logged-in user's authentication cookies. When a site administrator visits the reviews section to moderate content, the stored script executes in their browser session, granting the attacker admin-level access to the WordPress installation. No public POC has been identified, but the technique is well-understood and requires no specialized tooling.