CVE-2026-101159CWE-79cross-site-scripting

CVE-2026-101159

High · published October 3, 2026

CVSS v3.1

7.5

EPSS

Percentile

15.7

In the wild

Unconfirmed

What it is

The WP Ultimate Review WordPress plugin before 2.4.4 does not properly sanitise and escape reviews submitted through its public review form, which is available to unauthenticated visitors, allowing them to perform Stored Cross-Site Scripting attacks against any user, including administrators, viewing a page displaying the review, when user reviews are enabled.

The record

Technical detail

CVSS v3.1: 7.5 · HIGH
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.00252 · 15.7th percentile
Weakness: CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published: 2026-10-03T10:16Z

References (1)

https://wpscan.com/vulnerability/1eefa81e-6134-498b-9615-b9a42cd99749/ · [email protected]

EPSS history

Timeline

04 OCT 03:27Z
EPSS moved — → 0%
epss
03 OCT 06:00Z
WP Ultimate Review < 2.4.4 - Unauthenticated Stored XSS via Review Submission
cvelistv5