CVE-2026-94078
HighCVSS 7.1Summary
The Site Reviews plugin in versions <= 8.3.1 is vulnerable to unauthenticated Cross Site Scripting (XSS). An unauthenticated attacker can inject malicious script.
Risk Assessment
An unauthenticated attacker can execute malicious JavaScript in the victim's browser, potentially leading to credential theft or other actions within the user's session.
Recommendation
Update the Site Reviews plugin to a version higher than 8.3.1. Consider implementing security headers (CSP).
Other vulnerabilities in Site Reviews
See all- CVE-2026-118087Medium
The Site Reviews plugin by Gemini Labs (up to version 8.3.5) has a Cross-site Scripting (Stored XSS) vulnerability due to improper neutralization of input during web page generation.
- CVE-2026-103340Medium
Site Reviews plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control levels. Affects versions up to 8.3.2.
- CVE-2026-73382High
Stored XSS vulnerability in the Site Reviews plugin by Gemini Labs. Improper input neutralization during web page generation allows persistent script injection. Affects versions from n/a through 8.2.0.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in Site Reviews <= 8.3.1 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS