CVE-2026-92235: WP Ultimate Review <= 2.4.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_submit_review_data[xs_reviw_summery]' Parameter
The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.2. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes.
Affected Software
Event History
Frequently Asked Questions
Which users could exploit this issue?
Any authenticated user with Subscriber-level access or higher could exploit it. Unauthenticated visitors are not described as able to trigger the vulnerable behavior.
What does an attacker need to do to exploit it?
The attacker needs a valid WordPress account with at least Subscriber privileges and must submit a value through the xs_submit_review_data[xs_reviw_summery] parameter. The supplied value can then be processed with do_shortcode without proper validation.
Are installations running version 2.4.2 affected?
Yes. The issue affects all WP Ultimate Review versions up to and including 2.4.2.