WP Ultimate Review <= 2.4.4 - Unauthenticated Arbitrary Shortcode Execution via Reviewer Email Field
- ID
- WPSEC-2026-1239
- Plugin
- WP Ultimate Review (wp-ultimate-review)
- Affected
- all versions before 2.4.5
- Remediation
- Update to 2.4.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
- Weakness
- CWE-94
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-19
- Attack surface
- WP Ultimate Review on WPSec AttackSurface
- Fix released
- Published
Description
The WP Ultimate Review plugin for WordPress is vulnerable to Arbitrary Shortcode Execution via the reviewer email field of the front-end review form in all versions up to, and including, 2.4.4. This is due to the plugin escaping shortcode brackets in the other review fields but not in the reviewer email, which is stored after only sanitize_text_field() and is printed in the review list that the plugin appends to the post content before WordPress expands shortcodes. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes when the reviewed page is viewed, provided the site has enabled public display of reviewer emails.
References
- https://wpsec.com/vuln/WPSEC-2026-1239/
- https://plugins.svn.wordpress.org/wp-ultimate-review/tags/2.4.5/
- https://wordpress.org/plugins/wp-ultimate-review/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS