WordPress plugin
Site Reviews security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 21 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High4
- Medium17
- Low0
All Site Reviews vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium6.5 | Unauthenticated Arbitrary Shortcode Execution ≤8.3.6Update to 8.3.7 | CVE-2026-119494 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting ≤8.3.5Update to 8.3.6 | CVE-2026-118087 | |
| Medium5.3 | Missing Authorization ≤8.3.4Update to 8.3.5 | CVE-2026-110366 | |
| Medium5.3 | Missing Authorization ≤8.3.2Update to 8.3.3 | CVE-2026-103340 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤8.3.1Update to 8.3.2 | CVE-2026-94078 | |
| High8.1 | 8.2.2 - Unauthenticated PHP Object Injection 7.2.2 – 8.2.2Update to 8.3.0 | CVE-2026-82925 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤8.2.0Update to 8.2.1 | CVE-2026-73382 | |
| Medium4.3 | Authenticated (Subscriber+) Sensitive Information Exposure ≤8.0.11Update to 8.0.12 | CVE-2026-57318 | |
| Medium6.1 | Unauthenticated Stored Cross-Site Scripting ≤7.2.4Update to 7.2.5 | CVE-2025-1232 | |
| Medium5.3 | IP Address Spoofing to Blocking Bypass ≤6.11.8Update to 7.0.0 | CVE-2024-3050 | |
| Medium6.4 | Authenticated (Author+) Stored Cross-Site Scripting ≤6.11.6Update to 6.11.7 | CVE-2024-29095 | |
| Medium6.4 | Authenticated(Subscriber+) Stored Cross-Site Scripting via display name ≤6.11.4Update to 6.11.7 | CVE-2024-2293 | |
| Medium5.4 | Missing Authorization <6.10.3Update to 6.10.3 | CVE-2023-49832 | |
| Medium4.4 | Authenticated (Administrator+) Stored Cross-Site Scripting ≤6.7.0Update to 6.7.1 | CVE-2023-1525 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting via block attribute ≤6.5.1Update to 6.6.0 | CVE-2023-27629 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode ≤6.5.1Update to 6.6.0 | CVE-2023-27612 | |
| Medium5.4 | Missing Authorization ≤6.5.0Update to 6.6.0 | CVE-2023-27625 | |
| Medium6.5 | Unauthenticated CSV Injection ≤6.2.0Update to 6.4.0 | CVE-2022-46801 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤5.17.2Update to 5.17.3 | CVE-2021-24973 | |
| Medium5.5 | Admin+ Stored Cross-Site Scripting <5.13.1Update to 5.13.1 | CVE-2021-24603 | |
| Medium6.1 | Cross-Site Scripting <2.15.3Update to 2.15.3 | CVE-2018-0603 |
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
≤8.3.6Update to 8.3.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤8.3.5Update to 8.3.6
- Medium5.3Missing Authorization
≤8.3.4Update to 8.3.5
- Medium5.3Missing Authorization
≤8.3.2Update to 8.3.3
- High7.2Unauthenticated Stored Cross-Site Scripting
≤8.3.1Update to 8.3.2
- High8.18.2.2 - Unauthenticated PHP Object Injection
7.2.2 – 8.2.2Update to 8.3.0
- High7.2Unauthenticated Stored Cross-Site Scripting
≤8.2.0Update to 8.2.1
- Medium4.3Authenticated (Subscriber+) Sensitive Information Exposure
≤8.0.11Update to 8.0.12
- Medium6.1Unauthenticated Stored Cross-Site Scripting
≤7.2.4Update to 7.2.5
- Medium5.3IP Address Spoofing to Blocking Bypass
≤6.11.8Update to 7.0.0
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
≤6.11.6Update to 6.11.7
- Medium6.4Authenticated(Subscriber+) Stored Cross-Site Scripting via display name
≤6.11.4Update to 6.11.7
- Medium5.4Missing Authorization
<6.10.3Update to 6.10.3
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤6.7.0Update to 6.7.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via block attribute
≤6.5.1Update to 6.6.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
≤6.5.1Update to 6.6.0
- Medium5.4Missing Authorization
≤6.5.0Update to 6.6.0
- Medium6.5Unauthenticated CSV Injection
≤6.2.0Update to 6.4.0
- High7.2Unauthenticated Stored Cross-Site Scripting
≤5.17.2Update to 5.17.3
- Medium5.5Admin+ Stored Cross-Site Scripting
<5.13.1Update to 5.13.1
- Medium6.1Cross-Site Scripting
<2.15.3Update to 2.15.3
Site Reviews: common questions
Does Site Reviews have known vulnerabilities?
Yes. VulnCrest Radar lists 21 known vulnerabilities in Site Reviews: 4 high, 17 medium. None are known to affect version null.
How do I check which version of Site Reviews I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Site Reviews vulnerability?
CVE-2026-119494, published Nov 7, 2026: Site Reviews <= 8.3.6 - Unauthenticated Arbitrary Shortcode Execution. Severity: Medium (CVSS 6.5).
Is any Site Reviews vulnerability listed in CISA KEV?
No. None of the known Site Reviews vulnerabilities is currently listed in the CISA KEV catalog.