CVE-2026-101162 WP Ultimate Review CVE debrief

Who should care

Defenders responsible for WordPress installations with the WP Ultimate Review plugin should assess exposure and prioritize verification and remediation. This includes verifying plugin versions, monitoring for attacks, and restricting user access to prevent Stored Cross-Site Scripting attacks. Defenders should also review compensating controls for exposed systems and track exceptions and retest remediated assets.

Why it matters

The WP Ultimate Review plugin vulnerability could allow Stored Cross-Site Scripting attacks, requiring defenders to verify plugin versions, monitor for attacks, and restrict user access.

• Potential Stored Cross-Site Scripting attacks against users with author-level access
• Verification of plugin version and update to 2.4.4 or later
• Monitoring for potential attacks and restricting user roles and permissions

Technical summary

The WP Ultimate Review WordPress plugin before 2.4.4 does not escape some of its review overview settings before outputting them in posts, which could allow users with a role as low as author to perform Stored Cross-Site Scripting attacks when author reviews are enabled. This vulnerability requires defenders to verify plugin versions and update to 2.4.4 or later, as well as monitor for potential Stored Cross-Site Scripting attacks and restrict user roles and permissions. The WPScan reference provides primary source details for this issue.

Defensive priority

Defenders should prioritize verifying the version of the WP Ultimate Review plugin and ensuring that it is updated to 2.4.4 or later, as well as monitoring for potential Stored Cross-Site Scripting attacks.

Recommended defensive actions

• Verify the version of the WP Ultimate Review plugin and update to 2.4.4 or later
• Monitor for potential Stored Cross-Site Scripting attacks
• Restrict user roles and permissions to prevent author-level access to review settings
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability, with the primary source being the WPScan reference. Defenders should verify plugin versions and monitor for potential Stored Cross-Site Scripting attacks. The WP Ultimate Review plugin vulnerability could allow Stored Cross-Site Scripting attacks, requiring defenders to verify plugin versions, monitor for attacks, and restrict user access.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.