{"id":"CVE-2026-103234","kind":"vulnerability","aliases":["CVE-2026-103234"],"related":[],"title":"WP Ultimate Review WordPress plugin: unescaped review fields run shortcodes","description":"The WP Ultimate Review WordPress plugin before 2.4.5 does not neutralise shortcodes in all of the review fields submitted through its public review form, which is available to unauthenticated visitors, allowing them to execute arbitrary shortcodes when the affected field is displayed, provided user reviews and that field's display are enabled.","summary":"The WP Ultimate Review plugin before 2.4.5 does not neutralise shortcodes in its public review form fields. Unauthenticated visitors can submit shortcodes that execute when the review is displayed, which can expose data or perform actions allowed by those shortcodes.","severity":"medium","cvss":4.8,"epss":0.00225,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wp-ultimate-review"],"not_affected_if":["field-display-disabled","plugin-2.4.5-or-later","user-reviews-disabled"],"how_to_check":"- Check the installed version of the WP Ultimate Review plugin in the WordPress admin Plugins page or with `wp plugin get wp-ultimate-review --field=version`\n- Confirm whether user reviews and the affected review field display are enabled in the plugin settings","fix":"- Update WP Ultimate Review to `2.4.5` or later\n- Until updated, disable user reviews or the affected review field display in the plugin settings","status":"open","published_at":"2026-10-22T06:17:13+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:33:05+00:00","updated_at":"2026-10-25T04:33:05+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:33:05Z","model":"claude-haiku-5-5","output":{"fix":"- Update WP Ultimate Review to `2.4.5` or later\n- Until updated, disable user reviews or the affected review field display in the plugin settings","reach":"internet","title":"WP Ultimate Review WordPress plugin: unescaped review fields run shortcodes","impact":"medium","summary":"The WP Ultimate Review plugin before 2.4.5 does not neutralise shortcodes in its public review form fields. Unauthenticated visitors can submit shortcodes that execute when the review is displayed, which can expose data or perform actions allowed by those shortcodes.","category":"package","nicknames":[],"who_cares":["wordpress","wp-ultimate-review","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker-chosen shortcodes run when reviews are displayed to visitors","analyst_note":"","how_to_check":"- Check the installed version of the WP Ultimate Review plugin in the WordPress admin Plugins page or with `wp plugin get wp-ultimate-review --field=version`\n- Confirm whether user reviews and the affected review field display are enabled in the plugin settings","needs_analyst":false,"not_affected_if":["user-reviews-disabled","field-display-disabled","plugin-2.4.5-or-later"],"who_is_affected":"Sites running WP Ultimate Review before 2.4.5 that accept public reviews and display the affected review field. Sites without user reviews enabled, or with that field's display turned off, are not exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000616,"input_tokens":3373,"output_tokens":558,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-103234':13A,16A '-2026':12A,15A '2.4.5':32B,73C 'action':61B 'affect':104C 'allow':62B,96C 'arbitrari':100C 'avail':92C 'cve':11A,14A 'data':58B 'display':54B,107C,115C 'enabl':117C 'execut':49B,99C 'expos':57B 'field':8A,42B,83C,105C,113C 'form':41B,89C 'host':20B 'neutralis':35B,76C 'packag':17B 'perform':60B 'plugin':5A,30B,71C 'provid':108C 'public':39B,87C 'review':3A,7A,25B,29B,40B,52B,69C,82C,88C,110C 'run':9A 'self':19B 'self-host':18B 'shortcod':10A,36B,47B,65B,77C,101C 'submit':46B,84C 'ultim':2A,24B,28B,68C 'unauthent':43B,94C 'unescap':6A 'user':109C 'visitor':44B,95C 'wordpress':4A,21B,70C 'wp':1A,23B,27B,67C 'wp-ultimate-review':22B","nicknames":[],"mitigations":[],"who_affected":"Sites running WP Ultimate Review before 2.4.5 that accept public reviews and display the affected review field. Sites without user reviews enabled, or with that field's display turned off, are not exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T06:17:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103234","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103234","severity":null,"published_at":"2026-10-22T06:17:13+00:00","modified_at":"2026-10-22T15:16:14+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-103234","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103234","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}