Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: WP Ultimate Review 2.4.4 Clear all filters
TI-2026-67417 CVE-2026-101162 · GHSA-5x2w-pxc2-hmcq

WP Ultimate Review < 2.4.4 - Author+ Stored XSS via Review Overview Settings

Priority LOW 30

The WP Ultimate Review WordPress plugin before 2.4.4 does not escape some of its review overview settings before outputting them in posts, which could allow users with a role as low as author to perform Stored Cross-Site…

CVSS 3.1MEDIUM 6.4 Network High privileges User interaction EPSS 0.00294 Published 2026-10-03 Fixed in 2.4.4 CWE-79
TI-2026-67416 CVE-2026-101161 · GHSA-7j5c-34gf-rc4m

WP Ultimate Review < 2.4.4 - Unauthenticated DoS via Unset Display Settings in wp-reviews Shortcode

Priority LOW 39

The WP Ultimate Review WordPress plugin before 2.4.4 does not prevent unauthenticated users from storing crafted review content that makes the reviewed page fail with a fatal error on every subsequent visit, resulting in…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00407 Published 2026-10-03 Fixed in 2.4.4 CWE-400
TI-2026-67415 CVE-2026-101160 · GHSA-4g77-2gv7-vccg

WP Ultimate Review < 2.4.4 - Unauthenticated DoS via Non-Numeric Review Rating

Priority LOW 39

The WP Ultimate Review WordPress plugin before 2.4.4 does not validate that a submitted review rating is numeric before storing it and later using it in numeric operations when rendering reviews, allowing unauthenticated…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00407 Published 2026-10-03 Fixed in 2.4.4 CWE-400
TI-2026-67414 CVE-2026-101159 · GHSA-f5xc-wp62-2fgm

WP Ultimate Review < 2.4.4 - Unauthenticated Stored XSS via Review Submission

Priority LOW 34

The WP Ultimate Review WordPress plugin before 2.4.4 does not properly sanitise and escape reviews submitted through its public review form, which is available to unauthenticated visitors, allowing them to perform Stored…

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.00245 Published 2026-10-03 Fixed in 2.4.4 CWE-79