The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. (CVE-2026-103519)
The WP Ultimate Review plugin for WordPress versions up to and including 2.4.3 contains a vulnerability that allows authenticated users with subscriber-level access or higher to execute arbitrary shortcodes. This occurs because the plugin does not properly validate input before calling do_shortcode, enabling shortcode execution via the xs_review post type rendering. The vulnerability has a medium severity rating and a CVSS score of 5.4.
AI Analysis
Technical Summary
CVE-2026-103519 describes a vulnerability in the WP Ultimate Review WordPress plugin (up to version 2.4.3) where arbitrary shortcode execution is possible. The flaw arises from improper validation of a value before invoking do_shortcode, allowing authenticated users with subscriber-level privileges or above to execute arbitrary shortcodes. The attack leverages WordPress's strip_shortcodes() function, which unwraps double-bracketed shortcodes ([[tag]]) to single-bracketed ones ([tag]) that persist through wp_insert_post storage and execute when the xs_review post type content is rendered.
Potential Impact
An attacker with subscriber-level access or higher can execute arbitrary shortcodes, potentially leading to unauthorized actions or content manipulation within the WordPress site. The impact is limited to confidentiality and integrity with no direct availability impact. The CVSS score is 5.4 (medium severity). There are no known exploits in the wild.
Mitigation Recommendations
No patch or official fix is currently documented for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber-level user capabilities where possible and monitor for updates from the plugin vendor.
The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. (CVE-2026-103519)
Description
The WP Ultimate Review plugin for WordPress versions up to and including 2.4.3 contains a vulnerability that allows authenticated users with subscriber-level access or higher to execute arbitrary shortcodes. This occurs because the plugin does not properly validate input before calling do_shortcode, enabling shortcode execution via the xs_review post type rendering. The vulnerability has a medium severity rating and a CVSS score of 5.4.
CVSS v3.1
Score 5.4medium
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-103519 describes a vulnerability in the WP Ultimate Review WordPress plugin (up to version 2.4.3) where arbitrary shortcode execution is possible. The flaw arises from improper validation of a value before invoking do_shortcode, allowing authenticated users with subscriber-level privileges or above to execute arbitrary shortcodes. The attack leverages WordPress's strip_shortcodes() function, which unwraps double-bracketed shortcodes ([[tag]]) to single-bracketed ones ([tag]) that persist through wp_insert_post storage and execute when the xs_review post type content is rendered.
Potential Impact
An attacker with subscriber-level access or higher can execute arbitrary shortcodes, potentially leading to unauthorized actions or content manipulation within the WordPress site. The impact is limited to confidentiality and integrity with no direct availability impact. The CVSS score is 5.4 (medium severity). There are no known exploits in the wild.
Mitigation Recommendations
No patch or official fix is currently documented for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber-level user capabilities where possible and monitor for updates from the plugin vendor.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-98rc-jpvj-4hwx
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-103519"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ac13983a43b0b3b89d66f88
Added to database: 10/03/2026, 17:21:07 UTC
Last enriched: 10/03/2026, 17:31:16 UTC
Last updated: 10/04/2026, 02:46:02 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.