CVE-2026-101159: WP Ultimate Review < 2.4.4 - Unauthenticated Stored XSS via Review Submission

Q: Who can exploit this issue and who is at risk?

Any unauthenticated visitor can submit a malicious review if user reviews are enabled and the public review form is available. Any user who views a page displaying that review, including an administrator, may be exposed to the stored script.

Q: Are default deployments affected?

The issue requires user reviews to be enabled. Sites that do not enable user reviews or do not expose the public review form are not described as exploitable by the available information.

Q: What should be done if an update cannot be applied immediately?

Disable user reviews or otherwise prevent access to the public review submission form until the plugin can be updated. Review pages that display submitted reviews should also be checked for malicious content.

Q: How can I determine whether the site may already be affected?

Check whether WP Ultimate Review is earlier than version 2.4.4 and whether user reviews are enabled. Inspect existing submitted reviews, particularly those shown on public pages, for suspicious or unexpected content.

Published Oct 3, 2026

Updated

The WP Ultimate Review WordPress plugin before 2.4.4 does not properly sanitise and escape reviews submitted through its public review form, which is available to unauthenticated visitors, allowing them to perform Stored Cross-Site Scripting attacks against any user, including administrators, viewing a page displaying the review, when user reviews are enabled.

Affected Software

1 affected component

WP Ultimate Review<2.4.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WP Ultimate Review to a version that resolves this vulnerability.
Fixed in 2.4.4

Event History

Oct 3, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:16 AM

Description

Frequently Asked Questions

Who can exploit this issue and who is at risk?

Any unauthenticated visitor can submit a malicious review if user reviews are enabled and the public review form is available. Any user who views a page displaying that review, including an administrator, may be exposed to the stored script.

Are default deployments affected?

The issue requires user reviews to be enabled. Sites that do not enable user reviews or do not expose the public review form are not described as exploitable by the available information.

What should be done if an update cannot be applied immediately?

Disable user reviews or otherwise prevent access to the public review submission form until the plugin can be updated. Review pages that display submitted reviews should also be checked for malicious content.

How can I determine whether the site may already be affected?

Check whether WP Ultimate Review is earlier than version 2.4.4 and whether user reviews are enabled. Inspect existing submitted reviews, particularly those shown on public pages, for suspicious or unexpected content.

CVE-2026-101159: WP Ultimate Review < 2.4.4 - Unauthenticated Stored XSS via Review Submission

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue and who is at risk?

Are default deployments affected?

What should be done if an update cannot be applied immediately?

How can I determine whether the site may already be affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue and who is at risk?

Are default deployments affected?

What should be done if an update cannot be applied immediately?

How can I determine whether the site may already be affected?