Site Reviews CVE-2026-94078

Exploitation targets the Site Reviews WordPress plugin at versions <= 8.3.1 and requires no authentication (PR:N) but does require user interaction (UI:R) - a victim must load the page rendering the malicious content, so realistic abuse depends on the site accepting untrusted/public review submissions or otherwise rendering attacker-controlled input to a privileged viewer. The limiting factors are the need for victim interaction and the plugin being installed and exposed to untrusted input; impact is confined to the browser context (session/credential theft, action forgery) rather than direct server compromise.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) yields a 7.1 High score driven largely by the scope change (S:C) and unauthenticated network reach (PR:N). This is a stored/reflected Cross-Site Scripting flaw in a WordPress plugin, so the 'High' rating overstates raw danger relative to memory-corruption RCE: impact is capped at C:L/I:L/A:L and exploitation still requires victim user interaction (UI:R), typically an administrator or visitor loading an attacker-influenced page. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation - the appropriate characterization is 'no public exploit identified at time of analysis.' The unauthenticated angle (PR:N) is the most significant signal: for a public-facing review-submission plugin, unauthenticated XSS realistically maps to a visitor submitting a malicious review that later executes in a moderator/admin session. Treat this as a real, patch-worthy issue but not an emergency; prioritize based on whether the plugin is exposed to untrusted review submissions.

An unauthenticated attacker submits a product/site review (or crafts a request to a public plugin endpoint) containing a malicious JavaScript payload in an inadequately sanitized field. When a site administrator or another visitor views the review in the browser, the script executes in their session context, enabling cookie/session theft, admin-action forgery, or content injection. No public POC or exploit code was referenced in the provided data.