CVE-2026-101162 — WP Ultimate Review < 2.4.4 - Author+ Stored XSS via Review Overview Settings

CVE-2026-101162

WP Ultimate Review < 2.4.4 - Author+ Stored XSS via Review Overview Settings PUBLISHED

Description (CNA)

The WP Ultimate Review WordPress plugin before 2.4.4 does not escape some of its review overview settings before outputting them in posts, which could allow users with a role as low as author to perform Stored Cross-Site Scripting attacks, when author reviews are enabled.

Affected (CNA)

Vendor / product	Versions
Unknown / WP Ultimate Review	affected 0 before 2.4.4

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/b7a66222-4e30-4d70-9e2f-b91d421d285f/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.