CVE-2026-101162

WP Ultimate Review < 2.4.4 - Author+ Stored XSS via Review Overview Settings

The WP Ultimate Review WordPress plugin before 2.4.4 does not escape some of its review overview settings before outputting them in posts, which could allow users with a role as low as author to perform Stored Cross-Site Scripting attacks, when author reviews are enabled.

Affected

WP Ultimate Review

CVSS v3.1 CNA

6.4 MEDIUMCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H

EPSS

0.24% chance of exploitation in the next 30 days, 14th percentile

Published

2026-10-03

Proof-of-concept exploits (2)

• https://wpscan.com/vulnerability/b7a66222-4e30-4d70-9e2f-b91d421d285f/
• Hasyros/CVE-2026-101162-xss-wp-ultimate-review0★ · 2026-10-07

References

• CVE Record
• NVD entry

Related

• CVE-2026-101160
• CVE-2026-101161
• CVE-2026-76555
• CVE-2026-93661