EUVD-2026-91929
GHSA-f5xc-wp62-2fgm
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Unauthenticated public form submission gives AV:N/PR:N/AC:L; a privileged viewer is needed (UI:R); stored XSS executes in the victim's browser (S:C) with limited session-level C:L/I:L and no availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
6DescriptionCVE.org
The WP Ultimate Review WordPress plugin before 2.4.4 does not properly sanitise and escape reviews submitted through its public review form, which is available to unauthenticated visitors, allowing them to perform Stored Cross-Site Scripting attacks against any user, including administrators, viewing a page displaying the review, when user reviews are enabled.
AnalysisAI
Stored cross-site scripting in the WP Ultimate Review WordPress plugin before 2.4.4 lets unauthenticated visitors inject script through the plugin's public review form, which then runs in the browser of any user - including administrators - who later views the front-end page rendering that review. Publicly available exploit code exists, but the issue is not in CISA KEV and EPSS is only 0.17% (6th percentile), indicating low predicted exploitation activity. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two specific conditions drawn from the description: (1) the plugin's user-review feature must be enabled so that the public, unauthenticated review submission form is reachable, and (2) a victim - expressly including an administrator - must subsequently view the front-end page that renders the attacker-supplied review, satisfying the UI:R requirement. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals here point to a moderate, not emergency, priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade WP Ultimate Review to 2.4.4 or later, which is the only complete fix because the flaw sits in the plugin's review-submission handling rather than in generic WordPress core configuration; patch availability is confirmed by the vendor advisory at https://wpscan.com/vulnerability/1eefa81e-6134-498b-9615-b9a42cd99749/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every WordPress installation running WP Ultimate Review and flag any instance below version 2.4.4; where the public review form is not business-critical, disable it immediately, and begin applying the vendor-released patch 2.4.4 to internet-facing sites first, since the injection vector is unauthenticated and publicly available exploit code exists. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wp Ultimate Review
View allUnauthenticated attackers can persistently disable affected pages on WordPress sites running the WP Ultimate Review plug
Unauthenticated visitors can persistently break front-end page rendering on WordPress sites running the WP Ultimate Revi
Stored cross-site scripting in the WordPress plugin WP Ultimate Review affects all versions before 2.4.4, where some rev
Cross-Site Request Forgery (CSRF) vulnerability in Wpmet Wp Ultimate Review plugin <= 2.0.3 versions. Rated high severit
Cross-Site Request Forgery (CSRF) vulnerability in Wpmet Wp Ultimate Review plugin <= 2.2.4 versions. Rated high severit
Authenticated shortcode injection in the WP Ultimate Review WordPress plugin (Roxnor) allows any user with subscriber-le
Unauthenticated remote attackers can execute arbitrary registered WordPress shortcodes through the WP Ultimate Review pl
Arbitrary shortcode execution in the WP Ultimate Review WordPress plugin through version 2.4.3 lets any authenticated us
Authorization Bypass Through User-Controlled Key vulnerability in Wpmet Wp Ultimate Review.2.5. Rated medium severity (C
Missing Authorization vulnerability in Wpmet Wp Ultimate Review.2.5. Rated medium severity (CVSS 5.3), this vulnerabilit
Authentication Bypass by Spoofing vulnerability in Roxnor Wp Ultimate Review wp-ultimate-review allows Identity Spoofing
Missing authorization in Roxnor Wp Ultimate Review plugin versions up to 2.3.8 allows unauthenticated remote attackers t
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today