References https://www.wordfence.com/blog/2023/05/wpdeveloper-addresses-privilege-escalation-vulnerability-in-reviewx-wordpress-plugin/ https://patchstack.com/database/wordpress/plugin/reviewx/vulnerability/wordpress-reviewx-plugin-1-6-22-cross-site-scripting-xss-vulnerability https://avd.aliyun.com/detail?id=AVD-2024-43323 https://www.tenablecloud.cn/plugins/was/114263 https://avd.aliyun.com/detail?id=AVD-2023-2833 https://zone.ci/aliyun/ali_nvd/15455.html https://www.tenable.com/security/research/tra-2023-2 https://github.com/advisories/GHSA-vf78-px8h-wm3v https://freshysites.com/security-bulletins/wordpress-security-bulletin-reviewx-woocommerce-product-reviews-with-multi-criteria-reminder-emails-google-reviews-schema-more-plugin-vulnerability-cve-2025-10734/ https://techjacksolutions.com/scc-vendor-rollup/wordpress-reviewx-plugin-vulnerability-rollup-2026-03-26/ https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/reviewx/reviewx-woocommerce-product-reviews-with-multi-criteria-reminder-emails-google-reviews-schema-more-2212-unauthenticated-sensitive-information-exposure-to-data-export https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-reviewx-multi-criteria-rating-reviews-for-woocommerce-csv-injection-1-6-7/ https://avd.aliyun.com/product?prod=reviewx https://cve.imfht.com/product/ReviewX%20WordPress%20Plugin?lang=en
Related VulnerabilitiesPoCCVE-2026-41948: Dify <=1.14.1 - Unauthenticated Plugin Daemon Path TraversalJeecgBoot 积木报表 /jmreport/auto/export/python/plugin 代码执行漏洞Wordpress Events Calendar插件敏感信息泄露漏洞(CVE-2025-9808)WordPress Directory Kit 插件敏感信息泄露漏洞(CVE-2025-13920)PoCCVE-2025-14998: Branda WordPress plugin - Privilege EscalationPoCCVE-2022-1281: Photo Gallery WordPress v1.6.3 - SQL InjectionPoCCVE-2026-12394: WordPress MemberGlut < 1.1.5 - Unauthenticated Privilege EscalationPoCCVE-2026-55224: MineAdmin < 3.2.0-alpha.2 - Plugin Path Traversal to RCEPoCCVE-2019-1003030: Jenkins Pipeline Groovy Plugin <=2.63 - Insecure DeserializationPoCsimple-file-list-rce: WordPress Simple File List <=4.2.2 - Remote Code ExecutionPoCCVE-2026-13147: WordPress Kirki < 6.0.12 - Server-Side Request ForgeryPoCCVE-2026-14894: WordPress Super Forms <= 6.3.313 - Arbitrary File UploadPoCCVE-2026-17505: WordPress TranslatePress < 3.2.6 - Cross-Site Scripting