CVE-2026-103234 — WP Ultimate Review < 2.4.5 - Unauthenticated Arbitrary Shortcode Execution via Reviewer Email

CVE-2026-103234

WP Ultimate Review < 2.4.5 - Unauthenticated Arbitrary Shortcode Execution via Reviewer Email PUBLISHED

Description (CNA)

The WP Ultimate Review WordPress plugin before 2.4.5 does not neutralise shortcodes in all of the review fields submitted through its public review form, which is available to unauthenticated visitors, allowing them to execute arbitrary shortcodes when the affected field is displayed, provided user reviews and that field's display are enabled.

Affected (CNA)

Vendor / product	Versions
Unknown / WP Ultimate Review	affected 0 before 2.4.5

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/e7bd1750-babb-4a72-bb00-ca3d1ee228ce/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.