{"id":"CVE-2026-119494","kind":"vulnerability","aliases":["CVE-2026-119494"],"related":[],"title":"Site Reviews WordPress plugin: basic XSS lets attackers inject script into pages","description":"Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Gemini Labs Site Reviews site-reviews allows Code Injection.This issue affects Site Reviews: from n/a through 8.3.6.","summary":"Site Reviews, a WordPress plugin by Gemini Labs, fails to neutralize script-related HTML tags in a web page. An attacker can inject code that runs in visitors' browsers, per the NVD description.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","site-reviews","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed Site Reviews plugin version in the WordPress admin under Plugins; `8.3.6` or earlier is in the affected range.","fix":"- Site Reviews: move to a version later than `8.3.6`; the sources do not name the exact fixed version.","status":"open","published_at":"2026-11-07T10:17:08+00:00","first_seen_at":"2026-11-07T10:46:40+00:00","triaged_at":"2026-11-07T10:48:49+00:00","updated_at":"2026-11-07T10:48:49+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-07T10:48:49Z","model":"claude-haiku-5-5","output":{"fix":"- Site Reviews: move to a version later than `8.3.6`; the sources do not name the exact fixed version.","reach":"internet","title":"Site Reviews WordPress plugin: basic XSS lets attackers inject script into pages","impact":"medium","summary":"Site Reviews, a WordPress plugin by Gemini Labs, fails to neutralize script-related HTML tags in a web page. An attacker can inject code that runs in visitors' browsers, per the NVD description.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","site-reviews","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Script runs in visitors' browsers on the affected site","analyst_note":"Check the NVD entry and the WordPress plugin changelog for the fixed version and the vulnerable input.","how_to_check":"- Check the installed Site Reviews plugin version in the WordPress admin under Plugins; `8.3.6` or earlier is in the affected range.\n- unknown for other checks; the sources do not say which input or page is affected.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Site Reviews WordPress plugin version 8.3.6 or earlier are in the affected range. The sources do not say which features or inputs are exploitable, so unknown whether default configuration is enough to be exposed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000697,"input_tokens":4228,"output_tokens":549,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119494':15A,18A '-2026':14A,17A '8.3.6':94C 'affect':88C 'allow':84C 'attack':8A,48B 'basic':5A,73C 'browser':56B 'code':51B,85C 'cve':13A,16A 'descript':60B 'fail':35B 'gemini':33B,77C 'host':22B 'html':41B,67C 'improp':61C 'inject':9A,50B 'injection.this':86C 'issu':87C 'lab':34B,78C 'let':7A 'n/a':92C 'neutral':37B,62C 'nvd':59B 'packag':19B 'page':12A,46B,72C 'per':57B 'plugin':4A,31B 'relat':40B,66C 'review':2A,25B,28B,80C,83C,90C 'run':53B 'script':10A,39B,65C 'script-rel':38B,64C 'self':21B 'self-host':20B 'site':1A,24B,27B,79C,82C,89C 'site-review':23B,81C 'tag':42B,68C 'visitor':55B 'vulner':75C 'web':45B,71C 'wordpress':3A,26B,30B 'xss':6A,74C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Site Reviews WordPress plugin version 8.3.6 or earlier are in the affected range. The sources do not say which features or inputs are exploitable, so unknown whether default configuration is enough to be exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","selfhosted","sitereviews","wordpress"],"campaign_type":null,"search_a":"'-119494':15A,18A '-2026':14A,17A 'attack':8A 'basic':5A 'cve':13A,16A 'inject':9A 'let':7A 'page':12A 'plugin':4A 'review':2A 'script':10A 'site':1A 'wordpress':3A 'xss':6A","search_b":"'attack':48B 'browser':56B 'code':51B 'descript':60B 'fail':35B 'gemini':33B 'host':22B 'html':41B 'inject':50B 'lab':34B 'neutral':37B 'nvd':59B 'packag':19B 'page':46B 'per':57B 'plugin':31B 'relat':40B 'review':25B,28B 'run':53B 'script':39B 'script-rel':38B 'self':21B 'self-host':20B 'site':24B,27B 'site-review':23B 'tag':42B 'visitor':55B 'web':45B 'wordpress':26B,30B","search_c":"'8.3.6':94C 'affect':88C 'allow':84C 'basic':73C 'code':85C 'gemini':77C 'html':67C 'improp':61C 'injection.this':86C 'issu':87C 'lab':78C 'n/a':92C 'neutral':62C 'page':72C 'relat':66C 'review':80C,83C,90C 'script':65C 'script-rel':64C 'site':79C,82C,89C 'site-review':81C 'tag':68C 'vulner':75C 'web':71C 'xss':74C","first_public_at":"2026-11-07T10:17:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119494","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119494","severity":null,"published_at":"2026-11-07T10:17:08+00:00","modified_at":"2026-11-07T10:17:08+00:00","first_seen_at":"2026-11-07T10:46:40+00:00","fetched_at":"2026-11-07T10:46:40+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}