CVE-2026-101159 — WP Ultimate Review < 2.4.4 - Unauthenticated Stored XSS via Review Submission
The WP Ultimate Review WordPress plugin before 2.4.4 does not properly sanitise and escape reviews submitted through its public review form, which is available to unauthenticate…
Published: 2026-10-03 · CVSS: 7.5 · CVSS 3.1
The WP Ultimate Review WordPress plugin before 2.4.4 does not properly sanitise and escape reviews submitted through its public review form, which is available to unauthenticated visitors, allowing them to perform Stored Cross-Site Scripting attacks against any user, including administrators, viewing a page displaying the review, when user reviews are enabled.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7