TI-2026-86506 Aliases CVE-2026-119494 GHSA-whgw-738j-98fx

Cross-site scripting in WordPress Site Reviews plugin

LOW 39CWE-80Published 2026-11-07 · Updated 2026-11-07

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · None · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-80.

Summary

The Gemini Labs Site Reviews plugin for WordPress is affected from n/a through 8.3.6. Improper neutralization of script-related HTML tags (CWE-80) lets web page content be injected and executed. An unauthenticated remote attacker can exploit this over the network without user interaction, with low impact to confidentiality.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

Description from the CNA

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Gemini Labs Site Reviews site-reviews allows Code Injection.This issue affects Site Reviews: from n/a through 8.3.6.

Why it matters now

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Gemini Labs	Site Reviews	up to 8.3.6	—	No fix listed	CNA

Site Reviews VendorGemini Labs Affected up to 8.3.6 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Site Reviews.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

Timeline

2026-11-07 Threatist record created from CVE-2026-119494
2026-11-07 Alias added: GHSA-whgw-738j-98fx

References

Other 1

https://patchstack.com/database/wordpress/plugin/site-reviews/vulnerability/wordpress-site-reviews-plugin-8-3-6-content-injection-vulnerability?_s_id=cve

TI-2024-02856 Site Reviews < 7.0.0 - IP Spoofing CVSS 3.1CRITICAL 9.1
TI-2025-01056 Site Reviews < 7.2.5 - Unauthenticated Stored XSS CVSS 3.1HIGH 8.8
TI-2023-01439 Site Reviews < 6.7.1 - Admin+ Stored XSS CVSS 3.1MEDIUM 4.8
TI-2022-23147 WordPress Site Reviews Plugin <= 6.2.0 is vulnerable to CSV Injection CVSS 3.1CRITICAL 9.8
TI-2026-63298 WordPress Site Reviews plugin <= 8.3.1 - Cross Site Scripting (XSS) vulnerability CVSS 3.1HIGH 7.1
TI-2026-51501 WordPress Site Reviews plugin <= 8.2.0 - Cross Site Scripting (XSS) vulnerability CVSS 3.1HIGH 7.1

See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences