---
id: "CVE-2026-103234"
kind: "vulnerability"
aliases: ["CVE-2026-103234"]
title: "WP Ultimate Review WordPress plugin: unescaped review fields run shortcodes"
severity: "medium"
cvss: 4.8
epss: 0.00225
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "wordpress", "wp-ultimate-review"]
not_affected_if: ["field-display-disabled", "plugin-2.4.5-or-later", "user-reviews-disabled"]
published_at: "2026-10-22T06:17:13+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-25T04:33:05+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103234", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-103234", "first_seen_at": "2026-10-24T07:15:52+00:00"}]
---

# WP Ultimate Review WordPress plugin: unescaped review fields run shortcodes

The WP Ultimate Review plugin before 2.4.5 does not neutralise shortcodes in its public review form fields. Unauthenticated visitors can submit shortcodes that execute when the review is displayed, which can expose data or perform actions allowed by those shortcodes.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the WP Ultimate Review plugin in the WordPress admin Plugins page or with `wp plugin get wp-ultimate-review --field=version`
- Confirm whether user reviews and the affected review field display are enabled in the plugin settings

## Fix

- Update WP Ultimate Review to `2.4.5` or later
- Until updated, disable user reviews or the affected review field display in the plugin settings

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-103234
- 2026-10-24T07:15:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-103234

## From the sources

The WP Ultimate Review WordPress plugin before 2.4.5 does not neutralise shortcodes in all of the review fields submitted through its public review form, which is available to unauthenticated visitors, allowing them to execute arbitrary shortcodes when the affected field is displayed, provided user reviews and that field's display are enabled.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_