Live › vulnerability › CVE-2026-103234
Go to dashboardThe WP Ultimate Review plugin before 2.4.5 does not neutralise shortcodes in its public review form fields. Unauthenticated visitors can submit shortcodes that execute when the review is displayed, which can expose data or perform actions allowed by those shortcodes.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running WP Ultimate Review before 2.4.5 that accept public reviews and display the affected review field. Sites without user reviews enabled, or with that field's display turned off, are not exposed.
No product ranges from the sources yet.
wp plugin get wp-ultimate-review --field=version2.4.5 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The WP Ultimate Review WordPress plugin before 2.4.5 does not neutralise shortcodes in all of the review fields submitted through its public review form, which is available to unauthenticated visitors, allowing them to execute arbitrary shortcodes when the affected field is displayed, provided user reviews and that field's display are enabled.
This page as .md · .json · in your agent: get_signal("CVE-2026-103234")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.