Executive brief
ReviewX, a WordPress plugin used for managing customer reviews, contains a security flaw that allows unauthorized attackers to inject malicious scripts into the website. If a site administrator or visitor interacts with a specially crafted link or page, the attacker's script could execute in their browser. This could lead to unauthorized actions, theft of session information, or the redirection of users to malicious websites.
Technical details
A Cross-Site Scripting (XSS) vulnerability exists in the ReviewX plugin for WordPress (versions <= 2.3.10) due to improper neutralization of user-supplied input during web page generation (CWE-79). The vulnerability is unauthenticated, meaning an attacker does not need an account on the target site to initiate the attack. However, successful exploitation requires user interaction, typically from a privileged user (Reflected XSS). An attacker can leverage this to execute arbitrary JavaScript in the context of the victim's browser session, potentially leading to session hijacking or unauthorized administrative actions. The issue is resolved in version 2.3.11.
Affected products
- ReviewX ReviewX <= 2.3.10
Timeline
- 2026-05-17: disclosed: Reported by Psalms Christopher Matovu (ByteOverride)
- 2026-07-01: advisory: Patchstack published advisory
- 2026-07-02: advisory: NVD published CVE record
- 2026-07-02: patched: Version 2.3.11 released to address the vulnerability