CVE-2026-54863: WordPress Review Schema plugin <= 3.1.4 - Cross Site Scripting (XSS) vulnerability

Q: Which installations are affected?

Review Schema versions through 3.1.4 are affected. The available data does not identify a fixed version.

Q: What does an attacker need to exploit this issue?

The CVSS vector indicates the issue can be reached over the network with low attack complexity and requires no attacker privileges, but it does require user interaction. Exploitation involves reflected cross-site scripting.

Q: What is the potential impact?

Successful exploitation may affect confidentiality, integrity, and availability at a low level, and the impact scope can extend beyond the vulnerable component.

Published Nov 9, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mamunur Rashid Review Schema review-schema allows Reflected XSS.This issue affects Review Schema: from n/a through 3.1.4.

Affected Software

1 affected component

Mamunur Rashid Review Schema<=3.1.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Review Schema to a version that resolves this vulnerability.
Fixed in 3.1.5

Event History

Nov 9, 2026

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·10:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which installations are affected?

Review Schema versions through 3.1.4 are affected. The available data does not identify a fixed version.

What does an attacker need to exploit this issue?

The CVSS vector indicates the issue can be reached over the network with low attack complexity and requires no attacker privileges, but it does require user interaction. Exploitation involves reflected cross-site scripting.

What is the potential impact?

Successful exploitation may affect confidentiality, integrity, and availability at a low level, and the impact scope can extend beyond the vulnerable component.

CVE-2026-54863: WordPress Review Schema plugin <= 3.1.4 - Cross Site Scripting (XSS) vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which installations are affected?

What does an attacker need to exploit this issue?

What is the potential impact?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

What does an attacker need to exploit this issue?

What is the potential impact?