The WP Ultimate Review WordPress plugin before 2.4.4 does not properly sanitise and escape reviews submitted through its public review form, which… (CVE-2026-101159)
The WP Ultimate Review WordPress plugin versions before 2.4.4 contain a vulnerability where reviews submitted through the public review form are not properly sanitized and escaped. This form is accessible to unauthenticated visitors, enabling them to inject stored cross-site scripting (XSS) payloads. Any user, including administrators, viewing a page with such a malicious review can be affected.
AI Analysis
Technical Summary
The WP Ultimate Review WordPress plugin prior to version 2.4.4 fails to properly sanitize and escape user-submitted reviews via its public review form. Because this form is accessible without authentication, attackers can submit malicious scripts that are stored and later executed in the browsers of users viewing the affected pages. This constitutes a stored cross-site scripting vulnerability that can impact any user viewing the review content, including site administrators.
Potential Impact
Stored cross-site scripting allows attackers to execute arbitrary scripts in the context of the affected website for any user viewing the malicious review. This can lead to session hijacking, defacement, or other client-side attacks against users, including administrators. The vulnerability arises from improper input sanitization and escaping of user-submitted review content.
Mitigation Recommendations
A fix is available in WP Ultimate Review plugin version 2.4.4. Users should upgrade to version 2.4.4 or later to remediate this vulnerability. No additional mitigation guidance is provided or required beyond applying the official update.
The WP Ultimate Review WordPress plugin before 2.4.4 does not properly sanitise and escape reviews submitted through its public review form, which… (CVE-2026-101159)
Description
The WP Ultimate Review WordPress plugin versions before 2.4.4 contain a vulnerability where reviews submitted through the public review form are not properly sanitized and escaped. This form is accessible to unauthenticated visitors, enabling them to inject stored cross-site scripting (XSS) payloads. Any user, including administrators, viewing a page with such a malicious review can be affected.
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The WP Ultimate Review WordPress plugin prior to version 2.4.4 fails to properly sanitize and escape user-submitted reviews via its public review form. Because this form is accessible without authentication, attackers can submit malicious scripts that are stored and later executed in the browsers of users viewing the affected pages. This constitutes a stored cross-site scripting vulnerability that can impact any user viewing the review content, including site administrators.
Potential Impact
Stored cross-site scripting allows attackers to execute arbitrary scripts in the context of the affected website for any user viewing the malicious review. This can lead to session hijacking, defacement, or other client-side attacks against users, including administrators. The vulnerability arises from improper input sanitization and escaping of user-submitted review content.
Mitigation Recommendations
A fix is available in WP Ultimate Review plugin version 2.4.4. Users should upgrade to version 2.4.4 or later to remediate this vulnerability. No additional mitigation guidance is provided or required beyond applying the official update.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-f5xc-wp62-2fgm
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-101159"]
- State
- PUBLISHED
Threat ID: 6ac13997a43b0b3b89d699c2
Added to database: 10/03/2026, 17:21:27 UTC
Last enriched: 10/03/2026, 17:35:01 UTC
Last updated: 10/04/2026, 02:46:02 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.