Stored Cross-Site Scripting in Verified Reviews Plugin for WordPress

CVE-2026-94377

What is CVE-2026-94377?

The Verified Reviews plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input validation and a failure to escape output properly in the 'moderation' parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute whenever users access a compromised page. The flaw arises from the ntav_check_data() function, which erroneously utilizes loose comparison operators for signature verification, permitting attackers to bypass security checks. This poses significant risks to users interacting with affected pages.

References