Unknown Wp Ultimate Review vulnerabilities

4 CVEs affecting Unknown Wp Ultimate Review, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-101162, published 2026-10-03.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-101161, published 2026-10-03. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. The WP Ultimate Review WordPress plugin before 2.4.4 does not prevent unauthenticated users from storing crafted review content that makes the reviewed page fail with a fatal error on every…
CVE-2026-101160, published 2026-10-03. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. The WP Ultimate Review WordPress plugin before 2.4.4 does not validate that a submitted review rating is numeric before storing it and later using it in numeric operations when rendering reviews,…
CVE-2026-101159, published 2026-10-03. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. The WP Ultimate Review WordPress plugin before 2.4.4 does not properly sanitise and escape reviews submitted through its public review form, which is available to unauthenticated visitors, allowing…
CVE-2026-101162, published 2026-10-03. Medium severity, CVSS 6.4. EPSS: 0.2% chance of exploitation in the next 30 days. The WP Ultimate Review WordPress plugin before 2.4.4 does not escape some of its review overview settings before outputting them in posts, which could allow users with a role as low as author to…