What is GHSA-mq79-9v7w-xc5w?

GHSA-mq79-9v7w-xc5w is a security advisory published by GitHub Security Advisories with Medium severity. The WP Ultimate Review WordPress plugin before 2.4.5 does not neutralise shortcodes in all of the...

Which CVE IDs does GHSA-mq79-9v7w-xc5w cover?

GHSA-mq79-9v7w-xc5w covers the following CVE IDs: CVE-2026-103234. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-mq79-9v7w-xc5w?

GHSA-mq79-9v7w-xc5w has a CVSS v3 base score of 4.8, published by GitHub Security Advisories.

GHSA-mq79-9v7w-xc5wMediumCVSS 4.8

The WP Ultimate Review WordPress plugin before 2.4.5 does not neutralise shortcodes in all of the...

Vendor

GitHub Security Advisories

Published

October 22, 2026

Last Modified

October 22, 2026

🔗 CVE IDs covered (1)

CVE-2026-103234 →

📋 Description

The WP Ultimate Review WordPress plugin before 2.4.5 does not neutralise shortcodes in all of the review fields submitted through its public review form, which is available to unauthenticated visitors, allowing them to execute arbitrary shortcodes when the affected field is displayed, provided user reviews and that field's display are enabled.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-103234
https://wpscan.com/vulnerability/e7bd1750-babb-4a72-bb00-ca3d1ee228ce
https://github.com/advisories/GHSA-mq79-9v7w-xc5w