Plugin icon

WP Ultimate Review

wp-ultimate-review

Vulnerabilities:

16

Last Updated:

September 30, 2026

Active Installs:

60000

Published
Title
Fixed in
CVSS
Published
2026-10-02
Title
WP Ultimate Review < 2.4.4 - Unauthenticated Arbitrary Shortcode Execution via 'xs_reviw_summery' Parameter (Split-Shortcode / Late-Registered Shortcode)
Fixed in
Fixed in 2.4.4
CVSS
6.5 (medium)
Published
2026-10-02
Title
WP Ultimate Review < 2.4.4 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_reviw_summery' Parameter
Fixed in
Fixed in 2.4.4
CVSS
5.4 (medium)
Published
2026-10-01
Title
WP Ultimate Review < 2.4.4 - Unauthenticated DoS via Non-Numeric Review Rating
Fixed in
Fixed in 2.4.4
CVSS
5.9 (medium)
Published
2026-10-01
Title
WP Ultimate Review < 2.4.4 - Author+ Stored XSS via Review Overview Settings
Fixed in
Fixed in 2.4.4
CVSS
6.4 (medium)
Published
2026-10-01
Title
WP Ultimate Review < 2.4.4 - Unauthenticated Stored XSS via Review Submission
Fixed in
Fixed in 2.4.4
CVSS
7.5 (high)
Published
2026-10-01
Title
WP Ultimate Review < 2.4.4 - Unauthenticated DoS via Unset Display Settings in wp-reviews Shortcode
Fixed in
Fixed in 2.4.4
CVSS
5.9 (medium)
Published
2026-09-21
Title
WP Ultimate Review < 2.4.3 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_submit_review_data[xs_reviw_summery]' Parameter
Fixed in
Fixed in 2.4.3
CVSS
8.1 (high)
Published
2026-02-14
Title
Ultimate Review < 2.4.0 - Missing Authorization
Fixed in
Fixed in 2.4.0
CVSS
5.3 (medium)
Published
2025-12-07
Title
Ultimate Review < 2.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 2.3.8
CVSS
6.4 (medium)
Published
2024-04-17
Title
Wp Ultimate Review < 2.3.0 - Missing Authorization
Fixed in
Fixed in 2.3.0
CVSS
5.3 (medium)
Published
2024-04-17
Title
Wp Ultimate Review < 2.3.0 - Unauthenticated Insecure Direct Object Reference
Fixed in
Fixed in 2.3.0
CVSS
5.3 (medium)
Published
2024-04-17
Title
Wp Ultimate Review < 2.3.0 - Unauthenticated Review Restriction Bypass
Fixed in
Fixed in 2.3.0
CVSS
5.3 (medium)
Published
2024-01-05
Title
Wp Ultimate Review < 2.3.7 - IP Spoofing
Fixed in
Fixed in 2.3.7
CVSS
5.3 (medium)
Published
2023-10-22
Title
Wp Ultimate Review < 2.3.1 - Settings Update via CSRF
Fixed in
Fixed in 2.3.1
CVSS
4.3 (medium)
Published
2023-03-29
Title
Wp Ultimate Review < 2.1.0 - Admin+ Stored XSS
Fixed in
Fixed in 2.1.0
CVSS
3.5 (low)
Published
2023-03-29
Title
Wp Ultimate Review < 2.1.0 - Settings Update via CSRF
Fixed in
Fixed in 2.1.0
CVSS
4.3 (medium)