CVE-2026-101162
WP Ultimate Review < 2.4.4 - Author+ Stored XSS via Review Overview Settings
Unknown WP Ultimate Review
CVSS
6.4MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.24%Chance of exploitation activity in the next 30 days, higher than 14% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 2.4.4WP Ultimate ReviewCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
The WP Ultimate Review WordPress plugin before 2.4.4 does not escape some of its review overview settings before outputting them in posts, which could allow users with a role as low as author to perform Stored Cross-Site Scripting attacks, when author reviews are enabled.
Text from CVE List
Affected versions 1
- WP Ultimate Reviewaffected: all versions before 2.4.4CVE List