What’s Vulnerable › Products

Wpmet Wp Ultimate Review vulnerabilities

12 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 5 published in the last 12 months.

Check whether your Wpmet Wp Ultimate Review version is affected

Latest Wpmet Wp Ultimate Review vulnerabilities

• CVE-2026-103519 — WP Ultimate Review <= 2.4.3 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_reviw_summery' Parameter (CVSS 5.4)
• CVE-2026-100157 — WP Ultimate Review <= 2.4.3 - Unauthenticated Arbitrary Shortcode Execution via 'xs_reviw_summery' Parameter (Split-Shortcode / Late-Registered Shortcode) (CVSS 6.5)
• CVE-2026-92235 — WP Ultimate Review <= 2.4.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_submit_review_data[xs_reviw_summery]' Parameter (CVSS 8.1)
• CVE-2026-39644 — WordPress Wp Ultimate Review plugin <= 2.3.8 - Broken Access Control vulnerability (CVSS 5.3)
• CVE-2025-63057 — WordPress Wp Ultimate Review plugin <= 2.3.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
• CVE-2024-32685 — WordPress WP Ultimate Review plugin <= 2.2.5 - Review Score Manipulation vulnerability (CVSS 5.3)
• CVE-2024-21746 — WordPress Wp Ultimate Review plugin <= 2.3.6 - IP limit Bypass vulnerability (CVSS 7.5)
• CVE-2024-32684 — WordPress WP Ultimate Review plugin <= 2.2.5 - Broken Access Control on Review vulnerability (CVSS 7.5)
• CVE-2024-32683 — WordPress WP Ultimate Review plugin <= 2.2.5 - Insecure Direct Object References (IDOR) vulnerability (CVSS 7.5)
• CVE-2023-28987 — WordPress Wp Ultimate Review Plugin <= 2.0.3 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 8.8)
• CVE-2023-46085 — WordPress Wp Ultimate Review Plugin <= 2.2.4 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 8.8)
• CVE-2023-28751 — WordPress Wp Ultimate Review Plugin <= 2.0.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 4.8)