Read the docs
TI-2026-67414 Aliases CVE-2026-101159GHSA-f5xc-wp62-2fgm

WP Ultimate Review < 2.4.4 - Unauthenticated Stored XSS via Review Submission

Priority LOW 34CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-79.

Summary

The WP Ultimate Review WordPress plugin before 2.4.4 does not properly sanitise and escape reviews submitted through its public review form, which is available to unauthenticated visitors, allowing them to perform Stored Cross-Site Scripting attacks against any user, including administrators, viewing a page displaying the review, when user reviews are enabled.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00245 15th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed WP Ultimate Review (Unknown): 2.4.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownWP Ultimate Reviewbefore 2.4.42.4.4Patch availableCNA
  • WP Ultimate Review VendorUnknown Affected before 2.4.4 Fixed in 2.4.4 Patch available CNA

Remediation

  • Fix · CNA WP Ultimate Review (Unknown) Fixed in 2.4.4

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    WP Ultimate Review 2.4.4

    4 records Highest priority Priority LOW 4 LOW

    Other records, highest priority first

    • TI-2026-67416 WP Ultimate Review < 2.4.4 - Unauthenticated DoS via Unset Display Settings in wp-reviews ShortcodePriority LOW 39
    • TI-2026-67415 WP Ultimate Review < 2.4.4 - Unauthenticated DoS via Non-Numeric Review RatingPriority LOW 39
    • TI-2026-67417 WP Ultimate Review < 2.4.4 - Author+ Stored XSS via Review Overview SettingsPriority LOW 30
    Show all 4 records →

Timeline

  1. 2026-10-03 Threatist record created from CVE-2026-101159
  2. 2026-10-03 Alias added: GHSA-f5xc-wp62-2fgm
  3. 2026-10-03 CVSS score added · CISA ADP
  4. 2026-10-03 Weakness changed · CISA ADP
  5. 2026-10-03 CISA SSVC decision points changed

References

Exploit 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences