CVE-2026-101159

Name of the Vulnerable Software and Affected Versions WP Ultimate Review WordPress plugin versions prior to 2.4.4

Description Insufficient sanitization and escaping of reviews submitted via the public review form allow unauthenticated visitors to execute Stored Cross-Site Scripting (XSS) attacks. This occurs when user reviews are enabled, affecting any user, including administrators, who views a page displaying the malicious review.

Recommendations Update the plugin to version 2.4.4 or later.