CVE-2026-101162: WP Ultimate Review < 2.4.4 - Author+ Stored XSS via Review Overview Settings
The WP Ultimate Review WordPress plugin before 2.4.4 does not escape some of its review overview settings before outputting them in posts, which could allow users with a role as low as author to perform Stored Cross-Site Scripting attacks, when author reviews are enabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WP Ultimate Reviewto a version that resolves this vulnerability.Fixed in 2.4.4
Event History
Frequently Asked Questions
Which sites are exposed to this issue?
Sites using WP Ultimate Review versions earlier than 2.4.4 are affected when author reviews are enabled. The vulnerable output is in review overview settings rendered in posts.
What access does an attacker need?
An attacker needs an account with at least the Author role and the ability to submit or modify the affected review overview settings. The issue can then be used to store script content that is executed when the affected post output is viewed.
What should be prioritized for remediation?
Update WP Ultimate Review to version 2.4.4 or later. If updating cannot happen immediately, disable author reviews to remove the stated condition for exploitation and review existing review overview settings for injected script content.