Wp Ultimate Review Vulnerabilities

The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated atta...

CVSS:

6.5

(Wordfence)

Affected:

up to 2.4.3

Fixed in:

2.4.4

Disclosed:

Oct 2, 2026

CVE-2026-100157 on NVD →

The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attack...

CVSS:

5.4

(Wordfence)

Affected:

up to 2.4.3

Fixed in:

2.4.4

Disclosed:

Oct 2, 2026

CVE-2026-103519 on NVD →

The Ultimate Review plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.4.3. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever...

CVSS:

7.2

(Wordfence)

Affected:

up to 2.4.3

Fixed in:

2.4.4

Disclosed:

Oct 1, 2026

CVE-2026-101159 on NVD →

The Ultimate Review plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.4.3. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts i...

CVSS:

6.4

(Wordfence)

Affected:

up to 2.4.3

Fixed in:

2.4.4

Disclosed:

Oct 1, 2026

CVE-2026-101162 on NVD →

The Ultimate Review plugin for WordPress is vulnerable to Denial of Service in all versions up to, and including, 2.4.3. This is due to missing isset() guard on the review_location key of the display settings option, which is an empty string when never saved, causing a fatal PHP error when accessed as an array in the s...

CVSS:

5.3

(Wordfence)

Affected:

up to 2.4.3

Fixed in:

2.4.4

Disclosed:

Oct 1, 2026

CVE-2026-101161 on NVD →

The Ultimate Review plugin for WordPress is vulnerable to Denial of Service in all versions up to, and including, 2.4.3. This is due to missing is_numeric() validation on the user-supplied xs_reviwer_ratting field before it is stored and later used in numeric arithmetic operations during review rendering. This makes it...

CVSS:

5.3

(Wordfence)

Affected:

up to 2.4.3

Fixed in:

2.4.4

Disclosed:

Oct 1, 2026

CVE-2026-101160 on NVD →

The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.2. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attack...

CVSS:

8.1

(Wordfence)

Affected:

up to 2.4.2

Fixed in:

2.4.3

Disclosed:

Sep 21, 2026

CVE-2026-92235 on NVD →

The Ultimate Review plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 2.3.9. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

(Wordfence)

Affected:

up to 2.3.9

Fixed in:

2.4.0

Disclosed:

Feb 14, 2026

CVE-2026-39644 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Roxnor Wp Ultimate Review wp-ultimate-review allows DOM-Based XSS.This issue affects Wp Ultimate Review: from n/a through <= 2.3.6.

Affected:

up to 2.3.6

Fix:

No patched version reported

Disclosed:

Dec 9, 2025

CVE-2025-63057 on NVD →

The Ultimate Review plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.3.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages...

CVSS:

6.4

(Wordfence)

Affected:

up to 2.3.7

Fixed in:

2.3.8

Disclosed:

Dec 7, 2025

CVE-2025-63057 on NVD →

[en] Authentication Bypass by Spoofing vulnerability in Wpmet Wp Ultimate Review allows Functionality Bypass.This issue affects Wp Ultimate Review: from n/a through 2.3.2.

Affected:

up to 2.3.6

Fix:

No patched version reported

Disclosed:

May 17, 2024

CVE-2024-21746 on NVD →

[en] Client-Side Enforcement of Server-Side Security vulnerability in Wpmet Wp Ultimate Review allows Functionality Bypass.This issue affects Wp Ultimate Review: from n/a through 2.2.5.

Affected:

up to 2.3.0

Fixed in:

2.3.0

Disclosed:

May 17, 2024

CVE-2024-32685 on NVD →

[en] Missing Authorization vulnerability in Wpmet Wp Ultimate Review.This issue affects Wp Ultimate Review: from n/a through 2.2.5.

Affected:

up to 2.3.0

Fixed in:

2.3.0

Disclosed:

Apr 22, 2024

CVE-2024-32684 on NVD →

[en] Authorization Bypass Through User-Controlled Key vulnerability in Wpmet Wp Ultimate Review.This issue affects Wp Ultimate Review: from n/a through 2.2.5.

Affected:

up to 2.3.0

Fixed in:

2.3.0

Disclosed:

Apr 19, 2024

CVE-2024-32683 on NVD →

The Wp Ultimate Review plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the wur_meta_box_content_save() function in versions up to, and including, 2.2.5. This makes it possible for unauthenticated attackers to leave reviews on password protected posts.

CVSS:

5.3

(Wordfence)

Affected:

up to 2.2.5

Fixed in:

2.3.0

Disclosed:

Apr 17, 2024

CVE-2024-32684 on NVD →

The WP Ultimate Review plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.5 due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

(Wordfence)

Affected:

up to 2.2.5

Fixed in:

2.3.0

Disclosed:

Apr 17, 2024

CVE-2024-32683 on NVD →

The WP Ultimate Review plugin for WordPress is vulnerable to bypass review restrictions in all versions up to, and including, 2.2.5. This is due to the plugin not properly enforcing review restrictions. This makes it possible for unauthenticated attackers to review things multiple times.

CVSS:

5.3

(Wordfence)

Affected:

up to 2.2.5

Fixed in:

2.3.0

Disclosed:

Apr 17, 2024

CVE-2024-32685 on NVD →

The WP Ultimate Review plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 2.3.6 due to insufficient IP address validation and/or use of user-supplied HTTP headers as a primary method for IP retrieval. This makes it possible for unauthenticated attackers to bypass IP rate lim...

CVSS:

5.3

(Wordfence)

Affected:

up to 2.3.6

Fixed in:

2.3.7

Disclosed:

Jan 5, 2024

CVE-2024-21746 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in Wpmet Wp Ultimate Review plugin <= 2.0.3 versions.

Affected:

up to 2.1.0

Fixed in:

2.1.0

Disclosed:

Nov 12, 2023

CVE-2023-28987 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in Wpmet Wp Ultimate Review plugin <= 2.2.4 versions.

Affected:

up to 2.3.1

Fixed in:

2.3.1

Disclosed:

Oct 22, 2023

CVE-2023-46085 on NVD →

The Wp Ultimate Review plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.1. This is due to missing nonce validation on the wur_settings_view() function. This makes it possible for unauthenticated attackers to modify the plugin's settings via a forged request granted...

CVSS:

4.3

(Wordfence)

Affected:

up to 2.2.4

Fixed in:

2.3.1

Disclosed:

Oct 16, 2023

CVE-2023-46085 on NVD →

[en] Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Wpmet Wp Ultimate Review plugin <= 2.0.3 versions.

Affected:

up to 2.1.0

Fixed in:

2.1.0

Disclosed:

Jun 23, 2023

CVE-2023-28751 on NVD →

The Wp Ultimate Review plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 2.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitra...

CVSS:

4.4

(Wordfence)

Affected:

up to 2.0.3

Fixed in:

2.1.0

Disclosed:

Mar 29, 2023

CVE-2023-28751 on NVD →

The Wp Ultimate Review plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.3. This is due to missing nonce validation on several functions like wur_settings_view(). This makes it possible for unauthenticated attackers to perform unauthorized actions like modifying the...

CVSS:

4.3

(Wordfence)

Affected:

up to 2.0.3

Fixed in:

2.1.0

Disclosed:

Mar 29, 2023

CVE-2023-28987 on NVD →