The WP Ultimate Review plugin up to version 2.4.4 fails to neutralise shortcodes in review fields submitted via its public form, which is exposed to unauthenticated visitors. An attacker can inject arbitrary shortcodes into the review content; when the review is displayed, WordPress processes those shortcodes and executes any code they reference. This flaw allows code execution in the context of the site, potentially leading to remote code execution or cross‑site scripting against all visitors to the site.

All WordPress installations that have the WP Ultimate Review plugin installed in a version earlier than 2.4.5 are affected. The vulnerability is present in every release before 2.4.5; no further version granularity is available from the CNA.

The vulnerability is exploitable through a publicly accessible web form with no authentication required, making the attack vector web‑based. No EPSS value is provided, and the issue is not listed in the CISA KEV catalog, however the flaw permits arbitrary code execution which would be considered a low‑severity condition in a CVSS model, with a score of 4.8. Attacker effort is low: craft a review containing malicious shortcodes and submit it; the plugin renders the review, executing the code.