CVE-2026-103519Published
WP Ultimate Review <= 2.4.3 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_reviw_summery' Parameter
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-103519 · Microsoft / collected KEV context
cve-program · CVE-2026-103519
- https://www.wordfence.com/threat-intel/vulnerabilities/id/76986a3a-67f8-4d91-9f48-88fad356c3b4?source=cve
- https://plugins.trac.wordpress.org/browser/wp-ultimate-review/tags/2.4.3/app/content.php#L347
- https://plugins.trac.wordpress.org/browser/wp-ultimate-review/tags/2.4.3/app/content.php#L366
- https://plugins.trac.wordpress.org/browser/wp-ultimate-review/tags/2.4.3/init.php#L291
- https://plugins.trac.wordpress.org/browser/wp-ultimate-review/tags/2.4.3/app/content.php#L217
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3720426%40wp-ultimate-review&new=3720426%40wp-ultimate-review
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.