Description
The Reviews Sorted plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'space' parameter of the [reviews-slider] shortcode in all versions up to, and including, 2.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Published: 2025-12-12
Score: 6.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Stored Cross‑Site Scripting
Action: Apply Patch
AI Analysis

Impact

The Reviews Sorted plugin for WordPress suffers from stored cross‑site scripting in all releases up to 2.4.2. An authenticated user with Contributor level or higher can embed malicious script code through the 'space' attribute of the [reviews-slider] shortcode, which is then rendered and executed in the browsers of visitors who view the affected page. The flaw is caused by insufficient input sanitization and a lack of output escaping, enabling attackers to steal session cookies, deface content, or launch further attacks.

Affected Systems

WordPress sites running Reviews Sorted version 2.4.2 or earlier, produced by eurisko:Reviews Sorted.

Risk and Exploitability

The vulnerability has a CVSS score of 6.4, indicating medium severity, and an EPSS score of less than 1%, suggesting a low current exploitation probability. It is not listed in the CISA KEV catalog, so no public exploits are known. However, the requirement for authenticated Contributor+ access means any site granting such roles is at risk, and exploitation could affect all users who view injected content.

Generated by OpenCVE AI on April 21, 2026 at 17:27 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the Reviews Sorted plugin to version 2.4.3 or newer, which removes the vulnerable handling of the 'space' attribute.
  • If an upgrade is not possible, consider disabling or deleting the [reviews-slider] shortcode or uninstalling the plugin to eliminate the injection vector.
  • As a temporary measure, restrict Contributor+ role permissions from adding or editing shortcodes until the plugin is patch‑fixed or removed.

Generated by OpenCVE AI on April 21, 2026 at 17:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 15 Dec 2025 19:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 12 Dec 2025 09:00:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Vendors & Products Wordpress
Wordpress wordpress

Fri, 12 Dec 2025 03:45:00 +0000

Type Values Removed Values Added
Description The Reviews Sorted plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'space' parameter of the [reviews-slider] shortcode in all versions up to, and including, 2.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Title Reviews Sorted <= 2.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'space' Shortcode Attribute
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'}

Subscriptions

Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-08T17:01:15.115Z

Reserved: 2025-12-03T15:31:24.261Z

Link: CVE-2025-13969

cve-icon Vulnrichment

Updated: 2025-12-12T20:19:05.726Z

cve-icon NVD

Status : Deferred

Published: 2025-12-12T04:15:44.817

Modified: 2026-04-15T00:35:42.020

Link: CVE-2025-13969

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-21T17:30:37Z

Weaknesses