WP Ultimate Review <= 2.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Author Review Criteria Ratings
- ID
- WPSEC-2026-0046
- Plugin
- WP Ultimate Review (wp-ultimate-review)
- Affected
- from 2.1.0 before 2.4.4
- Remediation
- Update to 2.4.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- WP Ultimate Review on WPSec AttackSurface
- Fix released
- Published
Description
The WP Ultimate Review plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the author review criteria rating values stored in the 'xs_review_overview_settings' post meta in versions 2.1.0 to 2.4.3, due to missing output escaping. The plugin's own review meta box strips tags from these values on save, but the meta key is not protected, so a user who can edit a post can write it directly through WordPress's Custom Fields, and the rating and range values were echoed on the front end without escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
References
- https://wpsec.com/vuln/WPSEC-2026-0046/
- https://plugins.svn.wordpress.org/wp-ultimate-review/tags/2.4.4/
- https://wordpress.org/plugins/wp-ultimate-review/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS