WordPress Plugin Vulnerabilities

ReviewX – Multi-Criteria Reviews for WooCommerce with Google Reviews & Schema < 2.3.11 - Unauthenticated Stored Cross-Site Scripting

Description

The ReviewX – Multi-Criteria Reviews for WooCommerce with Google Reviews & Schema plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.3.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affects Plugins

Plugin icon
reviewx
Fixed in 2.3.11

References

CVE
CVE-2026-57359
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/e8c939e9-2b72-460b-9e76-560762752c28

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.2 (high)

Miscellaneous

Original Researcher
Psalms Christopher Matovu (ByteOverride)
Verified
No
WPVDB ID
89087ed8-b7f7-4de2-ab50-01240c690bbc

Timeline

Publicly Published
2026-07-01 (about 1 month ago)
Added
2026-07-07 (about 1 month ago)
Last Updated
2026-07-07 (about 1 month ago)

Other

Published
Title
Published
2025-09-12
Title
Calendar Plus <= 1.2.4 - Reflected Cross-Site Scripting
Published
2024-08-09
Title
Tutor LMS < 2.7.4 - Authenticated (Instructor+) Stored Cross-Site Scripting
Published
2024-02-19
Title
Schema & Structured Data for WP & AMP < 1.27 - Authenticated Stored XSS
Published
2026-07-23
Title
WP Hotel Booking < 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'widget_search' Shortcode Attribute
Published
2024-05-21
Title
WP Font Awesome Share Icons <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode