CVE-2026-103234: medium-severity vulnerability in WP Ultimate Review
WP Ultimate Review < 2.4.5 - Unauthenticated Arbitrary Shortcode Execution via Reviewer Email
Published
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 4.8epss 0.2%
exploitation probability
0.2%top 87% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
The WP Ultimate Review WordPress plugin before 2.4.5 does not neutralise shortcodes in all of the review fields submitted through its public review form, which is available to unauthenticated visitors, allowing them to execute arbitrary shortcodes when the affected field is displayed, provided user reviews and that field's display are enabled.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected products
Unknown · WP Ultimate Reviewpublic PoCs found — 1
cve_referencewpscan.com/vulnerability/e7bd1750-babb-4a72-bb00-ca3d1ee228ce/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — WP Ultimate Review
In the same product, most dangerous first.
CVE-2026-101161HIGHWP Ultimate Review < 2.4.4 - Unauthenticated DoS via Unset Display Settings in wp-reviews ShortcodeEPSS 0.4%CVE-2026-101160HIGHWP Ultimate Review < 2.4.4 - Unauthenticated DoS via Non-Numeric Review RatingEPSS 0.4%CVE-2026-101162MEDIUMWP Ultimate Review < 2.4.4 - Author+ Stored XSS via Review Overview SettingsEPSS 0.3%CVE-2026-101159HIGHWP Ultimate Review < 2.4.4 - Unauthenticated Stored XSS via Review SubmissionEPSS 0.2%