The WP Ultimate Review WordPress plugin before 2.4.4 does not escape some of its review overview settings before outputting them in posts, which… (CVE-2026-101162)
The WP Ultimate Review WordPress plugin versions before 2.4.4 contain a vulnerability where some review overview settings are not properly escaped before being output in posts. This flaw allows users with the author role, when author reviews are enabled, to perform stored Cross-Site Scripting (XSS) attacks.
AI Analysis
Technical Summary
The WP Ultimate Review WordPress plugin prior to version 2.4.4 fails to escape certain review overview settings before rendering them in posts. This improper output handling enables users with author-level permissions to inject and store malicious scripts, leading to stored XSS vulnerabilities if author reviews are enabled.
Potential Impact
An attacker with author-level access can exploit this vulnerability to execute stored Cross-Site Scripting attacks, potentially compromising the integrity of the website and affecting users who view the infected posts. This could lead to session hijacking, defacement, or other malicious actions via script execution in the context of the victim's browser.
Mitigation Recommendations
Upgrade the WP Ultimate Review plugin to version 2.4.4 or later, where this vulnerability is fixed. If upgrading is not immediately possible, consider disabling author reviews to prevent exploitation. Patch status is not explicitly confirmed in the input data, so verify with the vendor advisory for the latest remediation guidance.
The WP Ultimate Review WordPress plugin before 2.4.4 does not escape some of its review overview settings before outputting them in posts, which… (CVE-2026-101162)
Description
The WP Ultimate Review WordPress plugin versions before 2.4.4 contain a vulnerability where some review overview settings are not properly escaped before being output in posts. This flaw allows users with the author role, when author reviews are enabled, to perform stored Cross-Site Scripting (XSS) attacks.
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The WP Ultimate Review WordPress plugin prior to version 2.4.4 fails to escape certain review overview settings before rendering them in posts. This improper output handling enables users with author-level permissions to inject and store malicious scripts, leading to stored XSS vulnerabilities if author reviews are enabled.
Potential Impact
An attacker with author-level access can exploit this vulnerability to execute stored Cross-Site Scripting attacks, potentially compromising the integrity of the website and affecting users who view the infected posts. This could lead to session hijacking, defacement, or other malicious actions via script execution in the context of the victim's browser.
Mitigation Recommendations
Upgrade the WP Ultimate Review plugin to version 2.4.4 or later, where this vulnerability is fixed. If upgrading is not immediately possible, consider disabling author reviews to prevent exploitation. Patch status is not explicitly confirmed in the input data, so verify with the vendor advisory for the latest remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-5x2w-pxc2-hmcq
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-101162"]
- State
- PUBLISHED
Threat ID: 6ac13999a43b0b3b89d699ca
Added to database: 10/03/2026, 17:21:29 UTC
Last enriched: 10/03/2026, 17:35:14 UTC
Last updated: 10/04/2026, 02:46:02 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.