Stored Cross-Site Scripting Vulnerability in WP Ultimate Review Plugin by WordPress
CVE-2026-101159
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 3 October 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-101159?
The WP Ultimate Review plugin for WordPress, prior to version 2.4.4, fails to adequately sanitize and escape user-generated reviews submitted via its public review form, which is accessible to unauthenticated users. This oversight allows potential attackers to execute stored Cross-Site Scripting (XSS) attacks targeting anyone who views a page displaying these reviews, including site administrators. Proper handling of user input is crucial to prevent malicious scripts that could compromise site integrity and user data.
Affected Version(s)
WP Ultimate Review 0 < 2.4.4
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.