Site Reviews < 7.2.5 - Unauthenticated Stored XSS

Site Reviews WordPress plugin before 7.2.5 contains a stored cross-site scripting caused by improper sanitization and escaping of review fields, letting unauthenticated users execute malicious scripts, exploit requires no authentication. id: CVE-2025-1232 info: name: Site Reviews 7.2.5 -...

CVE-2026-10724

The Reviews Feed WordPress plugin before 2.6.5 does not neutralize WordPress shortcodes contained in third-party review content before rendering it through its dynamic block, allowing unauthenticated attackers to execute arbitrary shortcodes on pages that display the feed by planting a shortcode ...

CVE-2026-10081

The Unlimited Elements For Elementor WordPress plugin before 2.0.11 does not sanitize or escape Google review content fetched from the Serp API before rendering it in the Google Reviews widget output, allowing unauthenticated attackers who submit a malicious review on the targeted business's Goog...

EUVD-2026-45876

The Unlimited Elements For Elementor WordPress plugin before 2.0.11 does not sanitize or escape Google review content fetched from the Serp API before rendering it in the Google Reviews widget output, allowing unauthenticated attackers who submit a malicious review on the targeted business's Goog...

CVE-2026-10081

The CVE-2026-10081 entry affects the Unlimited Elements For Elementor WordPress plugin (pre-2.0.11). The issue is that Google review content fetched from the Serp API is not sanitized or escaped before rendering in the Google Reviews widget output. This permits unauthenticated attackers who submi...

EUVD-2026-45877

The Reviews Feed WordPress plugin before 2.6.5 does not neutralize WordPress shortcodes contained in third-party review content before rendering it through its dynamic block, allowing unauthenticated attackers to execute arbitrary shortcodes on pages that display the feed by planting a shortcode ...

CVE-2026-10724

The CVE concerns The Reviews Feed WordPress plugin prior to 2.6.5. The vulnerability arises because the plugin does not neutralize WordPress shortcodes present in third-party review content before rendering it via its dynamic block. This allows unauthenticated attackers to execute arbitrary short...

CVE-2026-10724 Reviews Feed < 2.6.5 - Unauthenticated Stored Arbitrary Shortcode Execution via Google Reviews

The Reviews Feed WordPress plugin before 2.6.5 does not neutralize WordPress shortcodes contained in third-party review content before rendering it through its dynamic block, allowing unauthenticated attackers to execute arbitrary shortcodes on pages that display the feed by planting a shortcode ...

CVE-2026-10081

The Unlimited Elements For Elementor WordPress plugin before 2.0.11 does not sanitize or escape Google review content fetched from the Serp API before rendering it in the Google Reviews widget output, allowing unauthenticated attackers who submit a malicious review on the targeted business's Goog...

CVE-2026-10724

The Reviews Feed WordPress plugin before 2.6.5 does not neutralize WordPress shortcodes contained in third-party review content before rendering it through its dynamic block, allowing unauthenticated attackers to execute arbitrary shortcodes on pages that display the feed by planting a shortcode ...

CVE-2026-10081 Unlimited Elements for Elementor < 2.0.11 - Unauthenticated Stored XSS via Google Reviews Widget

The Unlimited Elements For Elementor WordPress plugin before 2.0.11 does not sanitize or escape Google review content fetched from the Serp API before rendering it in the Google Reviews widget output, allowing unauthenticated attackers who submit a malicious review on the targeted business's Goog...

CVE-2026-12684 Customer Reviews for WooCommerce < 5.113.0 - Unauthenticated Arbitrary Media Upload via cr_upload_media

The Customer Reviews for WooCommerce WordPress plugin before 5.113.0 does not perform authentication, capability, or nonce checks on one of its media upload AJAX actions when the review media attachment feature is enabled, allowing unauthenticated users to upload media files bounded to an image a...

CVE-2026-12684

CVE-2026-12684 affects the Customer Reviews for WooCommerce WordPress plugin prior to version 5.113.0. The issue is an unauthenticated media upload via a media upload AJAX action when the review media attachment feature is enabled. The vulnerability arises from missing authentication, capability,...

CVE-2026-50502

creationtimestamp| type| source ---|---|--- 2026-07-14 19:01:38+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0231 2026-07-14 22:03:50+00:00| seen| https://www.thezdi.com/blog/2026/7/14/the-july-2026-security-update-review 2026-07-15 01:01:20+00:00| seen|...

CVE-2026-50456

creationtimestamp| type| source ---|---|--- 2026-07-14 19:01:35+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0231 2026-07-14 22:03:52+00:00| seen| https://www.thezdi.com/blog/2026/7/14/the-july-2026-security-update-review 2026-07-15 01:01:17+00:00| seen|...

CVE-2026-56649

creationtimestamp| type| source ---|---|--- 2026-07-14 19:01:33+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0231 2026-07-14 22:04:16+00:00| seen| https://www.thezdi.com/blog/2026/7/14/the-july-2026-security-update-review 2026-07-15 01:01:15+00:00| seen|...

CVE-2026-58528

creationtimestamp| type| source ---|---|--- 2026-07-14 19:01:30+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0231 2026-07-14 19:59:33+00:00| seen| https://bsky.app/profile/clueax.infosec.exchange.ap.brid.gy/post/3mqmymkfkvvl2 2026-07-14 22:04:56+00:00| seen|...

CVE-2026-50388

creationtimestamp| type| source ---|---|--- 2026-07-14 19:01:25+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0231 2026-07-14 22:04:22+00:00| seen| https://www.thezdi.com/blog/2026/7/14/the-july-2026-security-update-review 2026-07-15 01:01:05+00:00| seen|...

CVE-2026-57107

creationtimestamp| type| source ---|---|--- 2026-07-14 19:01:04+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0231 2026-07-14 22:03:36+00:00| seen| https://www.thezdi.com/blog/2026/7/14/the-july-2026-security-update-review 2026-07-15 01:00:58+00:00| seen|...

CVE-2026-55006

creationtimestamp| type| source ---|---|--- 2026-07-14 19:01:01+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0234 2026-07-14 22:03:05+00:00| seen| https://www.thezdi.com/blog/2026/7/14/the-july-2026-security-update-review 2026-07-15 01:00:55+00:00| seen|...