{
 "id": "WPSEC-2026-1239",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1239/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1239/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1239/index.md",
 "title": "WP Ultimate Review <= 2.4.4 - Unauthenticated Arbitrary Shortcode Execution via Reviewer Email Field",
 "description": "The WP Ultimate Review plugin for WordPress is vulnerable to Arbitrary Shortcode Execution via the reviewer email field of the front-end review form in all versions up to, and including, 2.4.4. This is due to the plugin escaping shortcode brackets in the other review fields but not in the reviewer email, which is stored after only sanitize_text_field() and is printed in the review list that the plugin appends to the post content before WordPress expands shortcodes. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes when the reviewed page is viewed, provided the site has enabled public display of reviewer emails.",
 "plugin": {
  "slug": "wp-ultimate-review",
  "name": "WP Ultimate Review",
  "full_name": "WP Ultimate Review",
  "wordpress_org": "https://wordpress.org/plugins/wp-ultimate-review/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-ultimate-review/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-ultimate-review"
 },
 "type": "RCE",
 "cwe": [
  "CWE-94"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.6,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.4.5",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.4.5"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.4.5",
 "remediation": "Update to 2.4.5 or later.",
 "fix_released": "2026-10-18T05:28:13+00:00",
 "published": "2026-10-19T05:45:14+00:00",
 "updated": "2026-10-18T10:55:28.521763+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1239/",
  "https://plugins.svn.wordpress.org/wp-ultimate-review/tags/2.4.5/",
  "https://wordpress.org/plugins/wp-ultimate-review/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-ultimate-review",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-19"
 }
}