CVE-2026-118087: WordPress Site Reviews plugin <= 8.3.5 - Cross Site Scripting (XSS) vulnerability

Q: Who can exploit this issue?

The CVSS vector indicates that an attacker needs low-level privileges and user interaction. The issue is remotely reachable and has low attack complexity.

Q: What impact could successful exploitation have?

This is a stored XSS issue. The supplied severity vector indicates potential low impact to confidentiality, integrity, and availability, with effects extending beyond the vulnerable security authority.

Q: Which versions are affected?

Site Reviews versions through 8.3.5 are affected. No fixed version is provided in the available data.

Published Oct 29, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gemini Labs Site Reviews site-reviews allows Stored XSS.This issue affects Site Reviews: from n/a through 8.3.5.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Site Reviews plugin to a version that resolves this vulnerability.
Fixed in 8.3.6

Event History

Oct 29, 2026

CVE Published

via MITRE·01:01 PM

Data Sourced

via MITRE·01:01 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

The CVSS vector indicates that an attacker needs low-level privileges and user interaction. The issue is remotely reachable and has low attack complexity.

What impact could successful exploitation have?

This is a stored XSS issue. The supplied severity vector indicates potential low impact to confidentiality, integrity, and availability, with effects extending beyond the vulnerable security authority.

Which versions are affected?