{"id":"CVE-2026-118087","kind":"vulnerability","aliases":["CVE-2026-118087"],"related":[],"title":"Site Reviews WordPress plugin: stored cross-site scripting through version 8.3.5","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gemini Labs Site Reviews site-reviews allows Stored XSS.This issue affects Site Reviews: from n/a through 8.3.5.","summary":"Site Reviews, a WordPress plugin by Gemini Labs, has a stored cross-site scripting flaw in versions through 8.3.5. An attacker who can submit content can plant script that runs in other visitors' browsers.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","site-reviews","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed Site Reviews plugin version in the WordPress admin under Plugins.\n- Compare the version against the fixed release named by the vendor; the sources do not give one.","fix":null,"status":"open","published_at":"2026-10-29T13:17:08+00:00","first_seen_at":"2026-10-29T13:25:07+00:00","triaged_at":"2026-10-29T13:25:43+00:00","updated_at":"2026-10-29T13:25:43+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-29T13:25:43Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Site Reviews WordPress plugin: stored cross-site scripting through version 8.3.5","impact":"medium","summary":"Site Reviews, a WordPress plugin by Gemini Labs, has a stored cross-site scripting flaw in versions through 8.3.5. An attacker who can submit content can plant script that runs in other visitors' browsers.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","site-reviews","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"script runs in visitors' browsers, may steal sessions","analyst_note":"Check the NVD entry and the Gemini Labs or WordPress plugin changelog for the fixed version and which user role can submit the malicious content.","how_to_check":"- Check the installed Site Reviews plugin version in the WordPress admin under Plugins.\n- Compare the version against the fixed release named by the vendor; the sources do not give one.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Site Reviews WordPress plugin at version 8.3.5 or earlier are in scope. The sources do not describe which submission paths or roles are needed to trigger the stored script, so the exact exposure is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000673,"input_tokens":4121,"output_tokens":522,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-118087':15A,18A '-2026':14A,17A '8.3.5':12A,46B,93C 'affect':87C 'allow':83C 'attack':48B 'browser':61B 'content':52B 'cross':7A,39B,71C 'cross-sit':6A,38B,70C 'cve':13A,16A 'flaw':42B 'gemini':33B,76C 'generat':69C 'host':22B 'improp':62C 'input':65C 'issu':86C 'lab':34B,77C 'n/a':91C 'neutral':63C 'packag':19B 'page':68C 'plant':54B 'plugin':4A,31B 'review':2A,25B,28B,79C,82C,89C 'run':57B 'script':9A,41B,55B,73C 'self':21B 'self-host':20B 'site':1A,8A,24B,27B,40B,72C,78C,81C,88C 'site-review':23B,80C 'store':5A,37B,84C 'submit':51B 'version':11A,44B 'visitor':60B 'vulner':74C 'web':67C 'wordpress':3A,26B,30B 'xss.this':85C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Site Reviews WordPress plugin at version 8.3.5 or earlier are in scope. The sources do not describe which submission paths or roles are needed to trigger the stored script, so the exact exposure is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T13:17:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118087","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118087","severity":null,"published_at":"2026-10-29T13:17:08+00:00","modified_at":"2026-10-29T13:17:08+00:00","first_seen_at":"2026-10-29T13:25:07+00:00","fetched_at":"2026-10-29T13:25:07+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}