CVE-2026-101162

MediumCVSS 6.4/10Last modified Oct 6, 2026

Description

The WP Ultimate Review WordPress plugin before 2.4.4 does not escape some of its review overview settings before outputting them in posts, which could allow users with a role as low as author to perform Stored Cross-Site Scripting attacks, when author reviews are enabled.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Oct 3, 2026
Last modified: Oct 6, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1011653.7The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify an order's payment state or the requested payment gateway CVE-2026-1011663.7The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify a product's publication status before creating an order fo CVE-2026-1011686.2GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 th CVE-2026-1011698.7In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafte CVE-2026-101174.3A weakness has been identified in Open5GS up to 2.7.7. This issue affects the function ogs_pool_id_calloc in the library /lib/sbi/nghttp2-se CVE-2026-1011704.0DoS vulnerability in the file parsing module. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2026-1011713.6Permission control vulnerability in the background task management module. Impact: Successful exploitation of this vulnerability may affect CVE-2026-1011726.2Permission control vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affect confidentiality.CVE-2026-1011736.5DoS vulnerability in the DSoftBus module. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2026-1011745.7DoS vulnerability in the DSoftBus module. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2026-1011754.3Null pointer dereference vulnerability in the ArkWeb module. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2026-1011767.1Permission control vulnerability in the event notification management module. Impact: Successful exploitation of this vulnerability may affe