CVE-2026-119494 · Package
NO FIX YET · SEE WHAT TO DO
Site Reviews, a WordPress plugin by Gemini Labs, fails to neutralize script-related HTML tags in a web page. An attacker can inject code that runs in visitors' browsers, per the NVD description.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the Site Reviews WordPress plugin version 8.3.6 or earlier are in the affected range. The sources do not say which features or inputs are exploitable, so unknown whether default configuration is enough to be exposed.
Not affected if plugin-not-installed
Who cares self-hosted, site-reviews, wordpress
8.3.6 or earlier is in the affected range.8.3.6; the sources do not name the exact fixed version.Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Gemini Labs Site Reviews site-reviews allows Code Injection.This issue affects Site Reviews: from n/a through 8.3.6.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.