CVE-2026-92412
Last modified
CVE-2026-92412 is a high-severity vulnerability rated 7.1/10 on the CVSS scale. The Five Star Restaurant Reviews WordPress plugin before 2.3.14 does not properly escape a user-supplied value before outputting it into an HTML tag, allowing unauthenticated attackers to inject arbitrary web script that runs in the browser of anyone tricked into submitting a crafted request, including a logged-in administrator..
Description
The Five Star Restaurant Reviews WordPress plugin before 2.3.14 does not properly escape a user-supplied value before outputting it into an HTML tag, allowing unauthenticated attackers to inject arbitrary web script that runs in the browser of anyone tricked into submitting a crafted request, including a logged-in administrator.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Five Star Restaurant Reviews | < 2.3.14 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-92412?
How severe is CVE-2026-92412?
How do I fix CVE-2026-92412?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-92405A security vulnerability has been detected in SourceCodester…7.3
- CVE-2026-92406A vulnerability was detected in SourceCodester Inventory and…7.3
- CVE-2026-92409The Donation Thermometer WordPress plugin before 2.3.0 does …6.8
- CVE-2026-9241The FOX – Currency Switcher Professional for WooCommerce plu…4.3
- CVE-2026-92410The Sign-up Sheets WordPress plugin before 2.4.0 does not pr…4.3
- CVE-2026-92411The WP Delicious WordPress plugin before 1.10.8 does not va…6.8
- CVE-2026-92413A flaw has been found in Artifex MuPDF up to b6d17493700c621…4.3
- CVE-2026-92414: Session Fixation / Session Reuse across Users vulnerabilit…9.1
- CVE-2026-92415— Use of Externally-Controlled Input to Select Classes or Co…5.3
- CVE-2026-92416A vulnerability has been found in Open5GS up to 2.8.0. Affec…4.3
- CVE-2026-92417A vulnerability was found in Open5GS up to 2.8.0. This affec…6.5
- CVE-2026-92418A vulnerability was determined in ChangeWeDer crm up to c07b…3.5
Are you affected by CVE-2026-92412?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST