CVE-2026-101159
7.5 HIGHPublished 2026-10-03 · Updated 2026-10-06
AI risk analysis
- Summary
- The WP Ultimate Review plugin allows unauthenticated users to submit reviews with malicious scripts that get stored and executed when other users view those reviews, potentially leading to admin compromise.
- Exploitability
- Exploitation requires a user to submit a review with XSS payload through the public form, which is relatively straightforward but depends on user interaction with the review display page.
- Blast radius
- The impact could be significant as attackers can execute scripts against any user who views affected review pages, including administrators with elevated privileges.
- Detection
- No reliable host or network indicator is derivable from the published description.
- Prioritized remediation
- Upgrade to version 2.4.4 or later to fix the stored XSS vulnerability in the WP Ultimate Review plugin.
Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
The WP Ultimate Review WordPress plugin before 2.4.4 does not properly sanitise and escape reviews submitted through its public review form, which is available to unauthenticated visitors, allowing them to perform Stored Cross-Site Scripting attacks against any user, including administrators, viewing a page displaying the review, when user reviews are enabled.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-79
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2026-103305
- HIGHCVE-2026-103309
- HIGHCVE-2026-86798
- HIGHCVE-2026-87761
- HIGHCVE-2026-87780
- HIGHCVE-2026-88826
- HIGHCVE-2026-88903
- HIGHCVE-2026-88905
Related by shared AI tags and CWE weakness class. Browse the full archive.