CVE-2026-94377

The Verified Reviews (Avis Vérifiés) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'moderation' parameter in all versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The authentication bypass is possible because ntav_check_data() uses loose != comparisons for signature verification, allowing a JSON body with boolean true values for idWebsite and sign to pass all checks on any configured installation.

• CWE-79

• https://plugins.trac.wordpress.org/browser/netreviews/trunk/api_functions.php#L1059
• https://plugins.trac.wordpress.org/browser/netreviews/trunk/api_functions.php#L1210
• https://plugins.trac.wordpress.org/browser/netreviews/trunk/api_functions.php#L517
• https://plugins.trac.wordpress.org/browser/netreviews/trunk/api_functions.php#L72
• https://plugins.trac.wordpress.org/browser/netreviews/trunk/includes/review_Pagination.php#L217
• https://plugins.trac.wordpress.org/browser/netreviews/trunk/netreviews.php#L69
• https://www.wordfence.com/threat-intel/vulnerabilities/id/a5ed3612-68c8-49a9-915d-c54e002506a4?source=cve

Published

Oct 14, 2026

Last Modified

Oct 14, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-94370A defect in the Qt for MCUs core string handling causes heap…6.5
• CVE-2026-94372MISP contains a stored cross-site scripting (XSS) vulnerabil…6.3
• CVE-2026-94373MISP contains a DOM-based cross-site scripting (XSS) vulnera…6.3
• CVE-2026-94374MISP contains an insecure direct object reference vulnerabil…8.3
• CVE-2026-94375The Order Export & Order Import for WooCommerce plugin for W…5.3
• CVE-2026-94376The Better Messages – Chat Rooms, Group Chat, Private Messag…6.4
• CVE-2026-94378The SupportCandy – AI Customer Support Ticket System & Live …6.4
• CVE-2026-94379The login() function in MISP's UsersController.php contained…6.9
• CVE-2026-9438A vulnerability was found in yashpokharna2555 StudentManagem…5.4
• CVE-2026-94381MISP has a security issue that can let a user gain more acce…8.7
• CVE-2026-94382Beszel before 0.19.0 contains an insecure direct object refe…4.2
• CVE-2026-94383The MISP blocklist workflow module accepted a user-supplied …8.6