Site Reviews EUVD-2026-60797

The Site Reviews plugin must be installed, active, and running at version 8.2.0 or earlier on a WordPress site. Public-facing unauthenticated review submission must be enabled, which is the plugin's default operational mode. A victim must subsequently load a WordPress page that renders the stored malicious review content - user interaction (UI:R) is a hard prerequisite for impact realization, meaning purely automated server-side exploitation is not possible. The attacker requires no WordPress account or credentials. Exploitation is bounded by visitor traffic to affected review pages; low-traffic sites reduce the attacker's opportunity window but do not eliminate risk.

The CVSS 7.1 score is well-grounded: network-accessible, low complexity, no attacker authentication, and a changed scope all elevate real-world risk above a typical reflected XSS. The sole friction is UI:R - a victim must load a page rendering the malicious review, preventing fully automated server-side exploitation. EPSS data is absent from the available intelligence, so statistical exploitation probability cannot be quantified. Neither a CISA KEV listing nor public POC code has been identified, which suggests active exploitation is not currently widespread. Nonetheless, the PR:N/AV:N/S:C combination means any public-facing WordPress site with the plugin enabled is a viable target requiring no attacker foothold, and even a small municipal IT team deploying this plugin in legnica or any similar environment should treat the update as urgent rather than routine patching. The primary risk scenario is stored XSS propagating to every visitor of a reviews page, multiplying victim exposure well beyond a single incident.

An unauthenticated attacker submits a review through the public Site Reviews submission form, embedding a crafted JavaScript payload in an unsanitized field such as the review body or reviewer name. The payload is persisted to the WordPress database and rendered to every subsequent visitor who loads a page displaying reviews. A victim visiting the page has the script executed in their browser, allowing the attacker to steal session cookies, redirect to phishing infrastructure, or perform authenticated actions within the WordPress session on the victim's behalf.