UNKNOWN NVD

CVE-2026-101159

The WP Ultimate Review WordPress plugin before 2.4.4 does not properly sanitise and escape reviews submitted through its public review form, which is available

The WP Ultimate Review WordPress plugin before 2.4.4 does not properly sanitise and escape reviews submitted through its public review form, which is available to unauthenticated visitors, allowing them to perform Stored Cross-Site Scripting attacks against any user, including administrators, viewing a page displaying the review, when user reviews are enabled.

References

https://wpscan.com/vulnerability/1eefa81e-6134-498b-9615-b9a42cd99749/

Published: 2026-10-03 · Source: NVD · Feed updated: 2026-10-03

This unknown severity vulnerability was published on 2026-10-03 via NVD.

vulnfeed aggregates 10770 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.