What is the CVSS score of EUVD-2026-91959?

EUVD-2026-91959 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

WP Ultimate Review EUVD-2026-91959

| CVE-2026-103519 MEDIUM

Code Injection (CWE-94)

2026-10-03 Wordfence

GHSA-98rc-jpvj-4hwx

WordPress RCE Code Injection Wp Ultimate Review Wordpress Plugin Roxnor

5.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Network-reachable web action, low complexity, requires subscriber authentication (PR:L); bounded shortcode execution yields Low confidentiality/integrity and no availability impact, scope unchanged.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Oct 03, 2026 - 07:40 vuln.today

CVE Published

Oct 03, 2026 - 06:38 nvd

MEDIUM 5.4

DescriptionCVE.org

The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes. The bypass relies on WordPress's own strip_shortcodes() function unwrapping the [[tag]] double-bracket escape to a bare [tag] that survives wp_insert_post storage and fires when the publicly queryable xs_review post type is rendered through the_content.

AnalysisAI

Arbitrary shortcode execution in the WP Ultimate Review WordPress plugin through version 2.4.3 lets any authenticated user with subscriber-level access or higher inject shortcodes that are stored and later executed when review content is rendered. The bypass abuses WordPress core behavior: the plugin passes attacker-controlled data into do_shortcode without validation, and the [[tag]] double-bracket escape is unwrapped to a bare [tag] by strip_shortcodes(), surviving wp_insert_post storage and firing through the_content on the publicly queryable xs_review post type. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Requires an authenticated account at subscriber level or above (PR:L), so the attacker must be able to register or already hold low-privilege credentials - practically significant where open user registration is enabled. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a medium-severity, authenticated issue that should be prioritized below unauthenticated or high-impact flaws. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Apply the upstream fix from the WP Ultimate Review changeset 3720426 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3720426%40wp-ultimate-review&new=3720426%40wp-ultimate-review); the plugin should be updated to a build newer than 2.4.3 - an exact released patched version number is not independently confirmed in the provided data, so verify the current plugin version in the WordPress.org repository before upgrading. … Detailed patch versions, workarounds, and compensating controls in full report.