CVE-2026-10724

MediumCVSS 4.8/10Last modified Jul 21, 2026

Description

The Reviews Feed WordPress plugin before 2.6.5 does not neutralize WordPress shortcodes contained in third-party review content before rendering it through its dynamic block, allowing unauthenticated attackers to execute arbitrary shortcodes on pages that display the feed by planting a shortcode in a review on the connected source.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-345

Affected software

Vendor	Product	Versions
Unknown	Reviews Feed	< 2.6.5

References

https://wpscan.com/vulnerability/7def5cf4-655d-424b-b1fc-eb333465434e/

Timeline

Published: Jul 20, 2026
Last modified: Jul 21, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1072407.6The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is no CVE-2026-1072417.6The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is no CVE-2026-1072429.1The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is no CVE-2026-1072437.6The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is no CVE-2026-1072447.6The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is no CVE-2026-1072457.5Versa has confirmed a buffer overflow vulnerability in the IPsec implementation on VOS, aka Versa FlexVNF.  Buffer Overflow Vulnerability CVE-2026-1072469.2The Plesk extension "Site Import" before 1.13.2 does not properly validate domain and session identifiers, allowing path traversal. This let CVE-2026-1072478.1An authorization bypass in Revive Adserver 6.0.0 through 6.0.8 allows an authenticated manager restricted to one agency to access or modify CVE-2026-1072488.8Thelia 3.0.0's back-office Email/Messages feature contains a server‑side template injection (SSTI) flaw that allows any authenticated user w CVE-2026-1072499.8Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Block AJAX allows Object Injection. T CVE-2026-107257.5Protocol::HTTP2 versions before 1.13 for Perl is vulnerable to a HTTP/2 Bomb. Protocol::HTTP2's inbound HPACK path has no header-list size CVE-2026-1072505.9Vulnerability in Drupal ECA Helper. This issue affects ECA Helper versions: *.*.