Threat database

The Verified Reviews (Avis Vérifiés) WordPress plugin versions up to and including 2.4.6 contain a stored cross-site scripting (XSS) vulnerability via the 'moderation' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when users access the affected pages. Additionally, an authentication bypass exists due to improper signature verification using loose comparisons, enabling attackers to bypass checks with crafted JSON payloads.

CVE-2026-81800 is a critical unauthenticated SQL Injection vulnerability affecting Verified Reviews (Avis Vérifiés) versions up to and including 2.4.6. This flaw allows an attacker to inject malicious SQL commands without authentication, potentially leading to high confidentiality impact and limited availability impact. The vulnerability has a CVSS score of 9.3, indicating a severe risk. No patch or remediation information is provided in the available data.