CVE-2026-100157

Name of the Vulnerable Software and Affected Versions WP Ultimate Review versions prior to 2.4.4

Description Unauthenticated attackers can execute arbitrary shortcodes because the software fails to properly validate a value before running the do shortcode() function. The required nonce is exposed to unauthenticated visitors through the public review form, and submitted payloads are auto-published by default, allowing exploitation without an account or privileged interaction.

Recommendations Update WP Ultimate Review to version 2.4.4 or later.