CVE WATCH / VULNERABILITY DETAIL
CVE-2026-103234
MEDIUMCVSS 4.8NVD feed
Published 22 October 2026 · tracked since 23 October 2026
Description
The WP Ultimate Review WordPress plugin before 2.4.5 does not neutralise shortcodes in all of the review fields submitted through its public review form, which is available to unauthenticated visitors, allowing them to execute arbitrary shortcodes when the affected field is displayed, provided user
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog