Advisories · Technology
roxnor WP Ultimate Review.
Every CVE that names roxnor WP Ultimate Review among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.5 Medium
WP Ultimate Review <= 2.4.3 - Unauthenticated Arbitrary Shortcode Execution via 'xs_reviw_summery' Parameter (Split-Shortcode / Late-Registered Shortcode)
- roxnor WP Ultimate Review
- Code injection
- CVSS 5.4 Medium
WP Ultimate Review <= 2.4.3 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_reviw_summery' Parameter
- roxnor WP Ultimate Review
- Code injection
- CVSS 8.1 High
WP Ultimate Review <= 2.4.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_submit_review_data[xs_reviw_summery]' Parameter
- roxnor WP Ultimate Review
- Code injection
- CVSS 5.3 Medium
WordPress Wp Ultimate Review plugin <= 2.3.8 - Broken Access Control vulnerability
- Roxnor Wp Ultimate Review
- Broken access control
- CVSS 6.5 Medium
WordPress Wp Ultimate Review plugin <= 2.3.7 - Cross Site Scripting (XSS) vulnerability
- Roxnor Wp Ultimate Review
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
WordPress Wp Ultimate Review plugin <= 2.3.6 - IP limit Bypass vulnerability
- Roxnor Wp Ultimate Review
- Authentication bypass