Live › vulnerability › CVE-2026-118087
Site Reviews, a WordPress plugin by Gemini Labs, has a stored cross-site scripting flaw in versions through 8.3.5. An attacker who can submit content can plant script that runs in other visitors' browsers.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 13:25 UTC. All times on this page are UTC.
Sites running the Site Reviews WordPress plugin at version 8.3.5 or earlier are in scope. The sources do not describe which submission paths or roles are needed to trigger the stored script, so the exact exposure is unknown.
No product ranges from the sources yet.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gemini Labs Site Reviews site-reviews allows Stored XSS.This issue affects Site Reviews: from n/a through 8.3.5.
This page as .md · .json · in your agent: get_signal("CVE-2026-118087")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.