The WP Ultimate Review plugin before version 2.4.5 does not neutralise shortcodes in all review fields submitted via its public review form. Because the form is available to unauthenticated visitors, an attacker can submit a review containing malicious shortcodes. When the reviewer field is later displayed by the plugin, WordPress parses and executes those shortcodes, which can run code supplied by the attacker. The vulnerability is a form of code injection (CWE‑94) and leads to unintended code execution within the context of the site.

All WordPress sites that have the WP Ultimate Review plugin installed in a version earlier than 2.4.5 are affected. No further version granularity is specified by the CNA, so every release before 2.4.5 is considered vulnerable.

The flaw is exploitable via a public web form that does not require authentication, making the attack vector web‑based. The EPSS score is less than 1 % and the vulnerability is not listed in the CISA KEV catalog. The CVSS score is 4.8, reflecting the potential for arbitrary code execution in the site’s context. Attacker effort is low: an attacker simply needs to craft a review containing malicious shortcodes and submit it through the public form, after which the site will render and execute the code.