CVE-2026-100157

Published 3 October 2026 · tracked since 3 October 2026

Description

The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-94505 HIGH 8.1
• CVE-2026-96267 HIGH 7.5
• CVE-2026-75028 HIGH 7.5
• CVE-2026-87115 CRITICAL 9.1
• CVE-2026-93889 HIGH 7.2
• CVE-2026-18443 HIGH 8.8
• CVE-2026-97341 HIGH 7.2
• CVE-2026-96650 HIGH 7.2
• CVE-2026-97337 HIGH 7.5
• CVE-2026-96564 HIGH 7.2

→ Open the live CVE board · all tools