CVE-2026-92235

Name of the Vulnerable Software and Affected Versions WP Ultimate Review versions prior to 2.4.3

Description Authenticated attackers with subscriber-level access and above can execute arbitrary shortcodes. This occurs because the software fails to properly validate a value before executing the do shortcode function. The issue is triggered via the xs submit review data[xs reviw summery] parameter.

Recommendations Update WP Ultimate Review to a version newer than 2.4.2. Avoid using the xs submit review data[xs reviw summery] parameter until the update is applied.