CVE-2026-103519

Name of the Vulnerable Software and Affected Versions WP Ultimate Review versions prior to 2.4.4

Description Authenticated users with subscriber-level access and above can execute arbitrary shortcodes. This occurs because the software fails to properly validate a value before executing the do shortcode() function. The issue is triggered when the strip shortcodes() function unwraps double-bracket escapes, allowing a shortcode to persist in the wp insert post storage and execute when the xs review post type is rendered via the content.

Recommendations Update WP Ultimate Review to version 2.4.4 or later.