Skip to content
Noroxi

WP Ultimate Review

wp-ultimate-review · plugin

Known security vulnerabilities for WP Ultimate Review. Find out in seconds which version runs on your site with WP Lens.

12 known vulnerabilities

8 exploitable without logging in · latest Oct 3, 2026

Listed on wordpress.org · latest 2.4.4 · last updated Sep 30, 2026 · 60K+ installs

wordpress.org status checked on Oct 5, 2026

Vulnerabilities

  • CVE-2023-28987unauthenticated · needs a click≤ 2.0.3

    WordPress Wp Ultimate Review Plugin <= 2.0.3 is vulnerable to Cross Site Request Forgery (CSRF)

    High 8.8

  • CVE-2023-46085unauthenticated · needs a click≤ 2.2.4

    WordPress Wp Ultimate Review Plugin <= 2.2.4 is vulnerable to Cross Site Request Forgery (CSRF)

    High 8.8

  • CVE-2026-92235subscriber+≤ 2.4.2

    WP Ultimate Review <= 2.4.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_submit_review_data[xs_reviw_summery]' Parameter

    High 8.1

  • CVE-2024-21746unauthenticated≤ 2.3.6

    WordPress Wp Ultimate Review plugin <= 2.3.6 - IP limit Bypass vulnerability

    High 7.5

  • CVE-2024-32684unauthenticated≤ 2.2.5

    WordPress WP Ultimate Review plugin <= 2.2.5 - Broken Access Control on Review vulnerability

    High 7.5

  • CVE-2024-32683unauthenticated≤ 2.2.5

    WordPress WP Ultimate Review plugin <= 2.2.5 - Insecure Direct Object References (IDOR) vulnerability

    High 7.5

  • CVE-2026-100157unauthenticated≤ 2.4.3

    WP Ultimate Review <= 2.4.3 - Unauthenticated Arbitrary Shortcode Execution via 'xs_reviw_summery' Parameter (Split-Shortcode / Late-Registered Shortcode)

    Medium 6.5

  • CVE-2025-63057login required≤ 2.3.7

    WordPress Wp Ultimate Review plugin <= 2.3.7 - Cross Site Scripting (XSS) vulnerability

    Medium 6.5

  • CVE-2026-103519subscriber+≤ 2.4.3

    WP Ultimate Review <= 2.4.3 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_reviw_summery' Parameter

    Medium 5.4

  • CVE-2026-39644unauthenticated≤ 2.3.8

    WordPress Wp Ultimate Review plugin <= 2.3.8 - Broken Access Control vulnerability

    Medium 5.3

  • CVE-2024-32685unauthenticated≤ 2.2.5

    WordPress WP Ultimate Review plugin <= 2.2.5 - Review Score Manipulation vulnerability

    Medium 5.3

  • CVE-2023-28751admin≤ 2.0.3

    WordPress Wp Ultimate Review Plugin <= 2.0.3 is vulnerable to Cross Site Scripting (XSS)

    Medium 4.8

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory