CVE-2026-94377: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in avisverifies Verified Reviews (Avis Vérifiés)

CVE-2026-94377 describes a stored cross-site scripting vulnerability in the Verified Reviews (Avis Vérifiés) WordPress plugin, affecting all versions up to 2.4.6. The vulnerability is triggered through the 'moderation' parameter, which lacks proper input sanitization and output escaping, allowing injection of malicious scripts. Moreover, the function ntav_check_data() performs signature verification using loose '!=' comparisons, permitting an authentication bypass by accepting JSON bodies with boolean true values for idWebsite and sign. This combination allows unauthenticated attackers to inject and execute arbitrary scripts in the context of users visiting the affected pages.

Successful exploitation allows unauthenticated attackers to perform stored cross-site scripting attacks, potentially leading to theft of user credentials, session hijacking, or other malicious actions executed in the context of the victim's browser. The authentication bypass increases the severity by allowing attackers to circumvent normal access controls to exploit the vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the affected plugin functionality. Avoid using the 'moderation' parameter with untrusted input and monitor for suspicious activity related to this plugin.