UNKNOWN NVD

CVE-2026-101162

The WP Ultimate Review WordPress plugin before 2.4.4 does not escape some of its review overview settings before outputting them in posts, which could allow use

The WP Ultimate Review WordPress plugin before 2.4.4 does not escape some of its review overview settings before outputting them in posts, which could allow users with a role as low as author to perform Stored Cross-Site Scripting attacks, when author reviews are enabled.

References

https://wpscan.com/vulnerability/b7a66222-4e30-4d70-9e2f-b91d421d285f/

Published: 2026-10-03 · Source: NVD · Feed updated: 2026-10-03

This unknown severity vulnerability was published on 2026-10-03 via NVD.

vulnfeed aggregates 10770 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.