Wp Ultimate Review
Monthly
Unauthenticated attackers can persistently disable affected pages on WordPress sites running the WP Ultimate Review plugin before 2.4.4 by submitting crafted review content that is stored and then triggers a fatal error on every subsequent page load. Confirmed exploitation conditions require the plugin to be installed and its review display settings to have never been saved (default unconfigured state); no authentication, user interaction, or non-default toggles are needed, and the impact is availability-only with no data compromise. Publicly available exploit code exists (documented by WPScan), and a vendor-released patch is available in version 2.4.4, so the practical exposure is limited to sites that have not yet saved their review display settings; EPSS is low at 0.16% (4th percentile), indicating a genuine but moderate-severity availability issue rather than a top-tier emergency.
Unauthenticated visitors can persistently break front-end page rendering on WordPress sites running the WP Ultimate Review plugin before version 2.4.4 whenever the plugin's user-review submission feature is enabled. A submitted review rating that is not a valid number is stored without validation and later fed into numeric operations during review rendering, producing a PHP fatal error that blocks the affected content for every visitor until an administrator deletes the offending review. Exploitation is trivial and publicly available exploit code exists via the WPScan advisory, but the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and the assessed profile confine impact to availability, and EPSS is only 0.16% (4th percentile), so this is a moderate, not critical, operational priority - configuration-gated, low-severity-per-event, and fully reversible by removing the injected review.
Stored cross-site scripting in the WP Ultimate Review WordPress plugin before 2.4.4 lets unauthenticated visitors inject script through the plugin's public review form, which then runs in the browser of any user - including administrators - who later views the front-end page rendering that review. Publicly available exploit code exists, but the issue is not in CISA KEV and EPSS is only 0.17% (6th percentile), indicating low predicted exploitation activity. Consistent with the independent assessment (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), exploitation is not automatic: the plugin's user-review feature must be enabled and a victim must actively view the poisoned review page, making this a moderate rather than emergency priority.
Authenticated shortcode injection in the WP Ultimate Review WordPress plugin (Roxnor) allows any user with subscriber-level access or higher to run arbitrary registered shortcodes on sites running version 2.4.2 or earlier. The attacker passes a crafted value to a plugin action that feeds it into do_shortcode() without validation (CWE-94), yielding high confidentiality and integrity impact per the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N (8.1). No public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV), but on sites with open registration the subscriber prerequisite is trivial to satisfy, and the real-world severity is bounded by which powerful shortcodes are registered by this or other installed plugins and themes - arbitrary operating-system command execution is not guaranteed.
Stored shortcode injection in the WP Ultimate Review WordPress plugin affects every version before 2.4.5: the public review form does not neutralise shortcode syntax in all review fields, so an unauthenticated visitor can submit a review containing arbitrary shortcodes that are then executed when that field is rendered on the site, provided user reviews and that field's display are enabled. The vendor has released 2.4.5 as the fix, and a public PoC reference exists; it is not verified as working exploit code, and there is no confirmed active exploitation (not in CISA KEV). Tracked as CVE-2026-103234 with a CVSS 3.1 base score of 4.8 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) and an EUVD record (EUVD-2026-108009), the realistic impact is bounded by which shortcodes are registered on the target site and by whether the affected field is actually displayed to a viewer.
Unauthenticated remote attackers can execute arbitrary registered WordPress shortcodes through the WP Ultimate Review plugin (versions up to and including 2.4.3), because the plugin passes an unvalidated value to do_shortcode and the only nonce gate is emitted to anonymous visitors via the public review form, while submitted reviews auto-publish without administrator approval by default. The CVSS 3.1 base score is 6.5 (Medium) with low confidentiality and integrity impact and no availability impact; the real-world severity depends on which shortcodes exist on the target site. No public exploit code has been identified at time of analysis, and CISA KEV does not list this issue.
Arbitrary shortcode execution in the WP Ultimate Review WordPress plugin through version 2.4.3 lets any authenticated user with subscriber-level access or higher inject shortcodes that are stored and later executed when review content is rendered. The bypass abuses WordPress core behavior: the plugin passes attacker-controlled data into do_shortcode without validation, and the [[tag]] double-bracket escape is unwrapped to a bare [tag] by strip_shortcodes(), surviving wp_insert_post storage and firing through the_content on the publicly queryable xs_review post type. There is no public exploit code identified at time of analysis and no confirmed active exploitation (CISA KEV); exploitation requires a low-privilege account, which makes it practically significant on sites with open user registration.
Stored cross-site scripting in the WordPress plugin WP Ultimate Review affects all versions before 2.4.4, where some review overview settings are written into post output without escaping. An authenticated user holding a role as low as Author can inject a persistent script payload, but only when the plugin's non-default 'author reviews' feature is explicitly enabled and only when another user - an administrator or site visitor - later renders the affected post. Publicly available exploit code exists and the WPScan/WordPress ecosystem has published an advisory, though EPSS is very low at 0.16% (5th percentile) and there is no evidence of active exploitation; this is a moderate, low-priority issue in practice given the required privileges and operator-configured precondition.
Missing authorization in Roxnor Wp Ultimate Review plugin versions up to 2.3.8 allows unauthenticated remote attackers to access restricted functionality through incorrectly configured access control security levels, resulting in limited information disclosure. The vulnerability carries a low EPSS exploitation probability (0.02%, 4th percentile) and has not been confirmed as actively exploited, though the simple attack vector (network-accessible, no complexity, no authentication required) means opportunistic exploitation is feasible.
Client-Side Enforcement of Server-Side Security vulnerability in Wpmet Wp Ultimate Review allows Functionality Bypass.2.5. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Authentication Bypass by Spoofing vulnerability in Roxnor Wp Ultimate Review wp-ultimate-review allows Identity Spoofing.3.6. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in Wpmet Wp Ultimate Review.2.5. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Authorization Bypass Through User-Controlled Key vulnerability in Wpmet Wp Ultimate Review.2.5. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in Wpmet Wp Ultimate Review plugin <= 2.0.3 versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in Wpmet Wp Ultimate Review plugin <= 2.2.4 versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Auth. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unauthenticated attackers can persistently disable affected pages on WordPress sites running the WP Ultimate Review plugin before 2.4.4 by submitting crafted review content that is stored and then triggers a fatal error on every subsequent page load. Confirmed exploitation conditions require the plugin to be installed and its review display settings to have never been saved (default unconfigured state); no authentication, user interaction, or non-default toggles are needed, and the impact is availability-only with no data compromise. Publicly available exploit code exists (documented by WPScan), and a vendor-released patch is available in version 2.4.4, so the practical exposure is limited to sites that have not yet saved their review display settings; EPSS is low at 0.16% (4th percentile), indicating a genuine but moderate-severity availability issue rather than a top-tier emergency.
Unauthenticated visitors can persistently break front-end page rendering on WordPress sites running the WP Ultimate Review plugin before version 2.4.4 whenever the plugin's user-review submission feature is enabled. A submitted review rating that is not a valid number is stored without validation and later fed into numeric operations during review rendering, producing a PHP fatal error that blocks the affected content for every visitor until an administrator deletes the offending review. Exploitation is trivial and publicly available exploit code exists via the WPScan advisory, but the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and the assessed profile confine impact to availability, and EPSS is only 0.16% (4th percentile), so this is a moderate, not critical, operational priority - configuration-gated, low-severity-per-event, and fully reversible by removing the injected review.
Stored cross-site scripting in the WP Ultimate Review WordPress plugin before 2.4.4 lets unauthenticated visitors inject script through the plugin's public review form, which then runs in the browser of any user - including administrators - who later views the front-end page rendering that review. Publicly available exploit code exists, but the issue is not in CISA KEV and EPSS is only 0.17% (6th percentile), indicating low predicted exploitation activity. Consistent with the independent assessment (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), exploitation is not automatic: the plugin's user-review feature must be enabled and a victim must actively view the poisoned review page, making this a moderate rather than emergency priority.
Authenticated shortcode injection in the WP Ultimate Review WordPress plugin (Roxnor) allows any user with subscriber-level access or higher to run arbitrary registered shortcodes on sites running version 2.4.2 or earlier. The attacker passes a crafted value to a plugin action that feeds it into do_shortcode() without validation (CWE-94), yielding high confidentiality and integrity impact per the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N (8.1). No public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV), but on sites with open registration the subscriber prerequisite is trivial to satisfy, and the real-world severity is bounded by which powerful shortcodes are registered by this or other installed plugins and themes - arbitrary operating-system command execution is not guaranteed.
Stored shortcode injection in the WP Ultimate Review WordPress plugin affects every version before 2.4.5: the public review form does not neutralise shortcode syntax in all review fields, so an unauthenticated visitor can submit a review containing arbitrary shortcodes that are then executed when that field is rendered on the site, provided user reviews and that field's display are enabled. The vendor has released 2.4.5 as the fix, and a public PoC reference exists; it is not verified as working exploit code, and there is no confirmed active exploitation (not in CISA KEV). Tracked as CVE-2026-103234 with a CVSS 3.1 base score of 4.8 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) and an EUVD record (EUVD-2026-108009), the realistic impact is bounded by which shortcodes are registered on the target site and by whether the affected field is actually displayed to a viewer.
Unauthenticated remote attackers can execute arbitrary registered WordPress shortcodes through the WP Ultimate Review plugin (versions up to and including 2.4.3), because the plugin passes an unvalidated value to do_shortcode and the only nonce gate is emitted to anonymous visitors via the public review form, while submitted reviews auto-publish without administrator approval by default. The CVSS 3.1 base score is 6.5 (Medium) with low confidentiality and integrity impact and no availability impact; the real-world severity depends on which shortcodes exist on the target site. No public exploit code has been identified at time of analysis, and CISA KEV does not list this issue.
Arbitrary shortcode execution in the WP Ultimate Review WordPress plugin through version 2.4.3 lets any authenticated user with subscriber-level access or higher inject shortcodes that are stored and later executed when review content is rendered. The bypass abuses WordPress core behavior: the plugin passes attacker-controlled data into do_shortcode without validation, and the [[tag]] double-bracket escape is unwrapped to a bare [tag] by strip_shortcodes(), surviving wp_insert_post storage and firing through the_content on the publicly queryable xs_review post type. There is no public exploit code identified at time of analysis and no confirmed active exploitation (CISA KEV); exploitation requires a low-privilege account, which makes it practically significant on sites with open user registration.
Stored cross-site scripting in the WordPress plugin WP Ultimate Review affects all versions before 2.4.4, where some review overview settings are written into post output without escaping. An authenticated user holding a role as low as Author can inject a persistent script payload, but only when the plugin's non-default 'author reviews' feature is explicitly enabled and only when another user - an administrator or site visitor - later renders the affected post. Publicly available exploit code exists and the WPScan/WordPress ecosystem has published an advisory, though EPSS is very low at 0.16% (5th percentile) and there is no evidence of active exploitation; this is a moderate, low-priority issue in practice given the required privileges and operator-configured precondition.
Missing authorization in Roxnor Wp Ultimate Review plugin versions up to 2.3.8 allows unauthenticated remote attackers to access restricted functionality through incorrectly configured access control security levels, resulting in limited information disclosure. The vulnerability carries a low EPSS exploitation probability (0.02%, 4th percentile) and has not been confirmed as actively exploited, though the simple attack vector (network-accessible, no complexity, no authentication required) means opportunistic exploitation is feasible.
Client-Side Enforcement of Server-Side Security vulnerability in Wpmet Wp Ultimate Review allows Functionality Bypass.2.5. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Authentication Bypass by Spoofing vulnerability in Roxnor Wp Ultimate Review wp-ultimate-review allows Identity Spoofing.3.6. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in Wpmet Wp Ultimate Review.2.5. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Authorization Bypass Through User-Controlled Key vulnerability in Wpmet Wp Ultimate Review.2.5. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in Wpmet Wp Ultimate Review plugin <= 2.0.3 versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in Wpmet Wp Ultimate Review plugin <= 2.2.4 versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Auth. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.