Verified Reviews CVE-2026-94377

Exploitation requires reaching the plugin's unauthenticated review/moderation API endpoint and sending a JSON request body with boolean true values for idWebsite and sign; because ntav_check_data() uses loose '!=' comparisons, this bypasses signature verification on ANY configured installation of the Verified Reviews (Avis Vérifiés) plugin, with no account, token, or user interaction from the attacker. Works against default configurations of all versions up to and including 2.4.6. The principal limiting factor is that the stored payload is passive until a user (visitor or admin) subsequently loads the page containing the injected 'moderation' content, and impact is confined to the browser/client context (no server-side code execution); risk is highest where the injected page is viewed by privileged users.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2 HIGH) describes a network-reachable, low-complexity, unauthenticated stored XSS with a scope change - all signals that favor practical exploitability, and the description corroborates PR:N by detailing a concrete authentication bypass (ntav_check_data() using loose '!=' comparisons so a JSON body with boolean true for idWebsite and sign passes signature checks on any installation). This is a genuine unauthenticated-write primitive rather than a theoretical one, which elevates it above a typical authenticated-XSS plugin bug. However, several real-risk dampeners apply: no EPSS score was provided, the CVE is NOT on the CISA KEV list, and no public proof-of-concept is indicated in the supplied data, so there is no public exploit identified at time of analysis. Impact is bounded (C:L/I:L, A:N) because the payload runs in a victim's browser session, not on the server. Net assessment: a credible, prioritize-for-patching issue for sites running this plugin due to the unauthenticated vector, but current evidence points to no confirmed in-the-wild activity, so it is high-potential rather than confirmed-active. No signal conflict was detected between the CVSS vector and the description - both agree on unauthenticated network exploitation.

An unauthenticated attacker sends a crafted HTTP request to the plugin's API endpoint with a JSON body containing boolean true values for idWebsite and sign, bypassing the signature check, then submits a malicious script through the 'moderation' parameter. The payload is stored and later executes in the browser of any user (including administrators) who views the affected page, enabling session/cookie theft or admin-context actions. No public exploit is identified at time of analysis, and the attack requires no authentication or user interaction by the attacker beyond a victim later loading the injected page.