What is the CVSS score of CVE-2026-57359?

CVE-2026-57359 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of ReviewX are affected by CVE-2026-57359?

ReviewX WordPress plugin versions 2.3.10 and earlier contain an unauthenticated cross-site scripting vulnerability that allows attackers to inject malicious scripts into victim browsers, enabling…

How to fix or mitigate CVE-2026-57359?

Within 24 hours: Identify all sites running ReviewX plugin and document affected versions via WordPress admin panel or security scanner. Within 7 days: Evaluate plugin alternatives or review Patchstack for temporary workarounds; consider disabling ReviewX if not business-critical to reduce exposure. Within 30 days: Deploy Web Application Firewall rules to filter XSS payloads, implement strict Content Security Policy (CSP) headers, and update plugin immediately if vendor releases patch; monitor Patchstack and WordPress.org for security updates.

ReviewX CVE-2026-57359

EUVD-2026-41358 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-02 Patchstack

GHSA-955x-rgqj-gjh7

WordPress XSS Reviewx Wordpress Plugin

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Network-reachable unauthenticated XSS (AV:N/PR:N) requiring victim interaction (UI:R) with scope change into the browser (S:C) and limited browser-context impact (C/I/A:L).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:16 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in ReviewX <= 2.3.10 versions.

AnalysisAI

Reflected/stored Cross-Site Scripting in the ReviewX WordPress plugin (versions 2.3.10 and earlier) allows unauthenticated remote attackers to inject arbitrary JavaScript that executes in a victim's browser when they interact with a crafted request or page. The scope-changed CVSS 3.1 score of 7.1 (PR:N/UI:R) reflects that no authentication is required but a victim must be lured into triggering the payload. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so this is a disclosed-but-not-yet-actively-exploited plugin flaw reported by Patchstack.

Technical ContextAI

ReviewX is a WordPress plugin providing multi-criteria product/business review functionality (commonly paired with WooCommerce). The affected component is identified only by the wildcard CPE cpe:2.3:a:reviewx:reviewx:*:*:*:*:*:*:*:* covering all versions up to 2.3.10. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-supplied input - likely a review field or request parameter reachable without authentication - is rendered back into an HTML/JS context without proper output encoding or sanitization, letting attacker-controlled markup execute as script in the browser DOM.

RemediationAI

Update the ReviewX plugin to a version later than 2.3.10 as published by the vendor; the provided data does not include an exact fixed version number, so consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/reviewx/vulnerability/wordpress-reviewx-plugin-2-3-10-cross-site-scripting-xss-vulnerability?_s_id=cve) and the WordPress plugin repository changelog to confirm the specific patched release before deploying. If an immediate update is not possible, deploy a Web Application Firewall (such as Patchstack's own virtual patch or WordPress security plugins) with rules to filter XSS payloads targeting ReviewX endpoints, and restrict or disable public/unauthenticated review submission if the deployment allows it - noting this trade-off removes legitimate visitor review functionality. Adding a restrictive Content-Security-Policy that disallows inline script can also blunt payload execution, at the cost of breaking any legitimate inline scripts on affected pages.