CVE-2026-73382: Site Reviews XSS Vulnerability

CVE-2026-73382 Overview

CVE-2026-73382 is an unauthenticated Cross-Site Scripting (XSS) vulnerability affecting the Site Reviews WordPress plugin in versions up to and including 8.2.0. The flaw allows remote attackers to inject arbitrary JavaScript that executes in the browser of any user who interacts with a crafted request or page. Because exploitation requires no authentication, any visitor to a site running a vulnerable plugin version can be targeted. The issue is tracked under CWE-79 and was published to the National Vulnerability Database (NVD) on 2026-08-18.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in victim browsers, enabling session theft, credential harvesting, and administrative account takeover through crafted review submissions.

Affected Products

Site Reviews WordPress plugin versions <= 8.2.0
WordPress sites hosting the Site Reviews plugin
Any WordPress deployment exposing the plugin's review submission surface to unauthenticated users

Discovery Timeline

2026-08-18 - CVE-2026-73382 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-73382

Vulnerability Analysis

The vulnerability is a stored or reflected Cross-Site Scripting (XSS) flaw in the Site Reviews plugin classified under [CWE-79]. The plugin fails to properly neutralize user-supplied input before rendering it in web pages. An unauthenticated attacker can submit crafted input containing JavaScript payloads that the plugin later serves to other users without adequate sanitization or output encoding.

The attack requires user interaction, meaning a victim must load a page containing the malicious payload or follow an attacker-controlled link. When the payload executes, it runs in the context of the vulnerable site's origin. This scope change enables the attacker to access cookies, local storage, and any authenticated session context available in the victim's browser.

Successful exploitation can lead to account hijacking against site administrators, defacement, phishing overlays, and pivoting to further WordPress compromise through privileged actions performed on behalf of the victim.

Root Cause

The root cause is insufficient input validation and output encoding in the Site Reviews plugin's handling of review-related fields. User-controlled data reaches an HTML rendering context without being escaped, allowing <script> tags and event-handler attributes to survive into the DOM.

Attack Vector

The attack vector is network-based and requires no privileges. An attacker submits a crafted payload through a publicly accessible plugin endpoint, such as a review submission form. When an administrator or another user later views the affected page, the injected script executes with the site's origin permissions. See the Patchstack advisory for CVE-2026-73382 for additional technical context.

Detection Methods for CVE-2026-73382

Indicators of Compromise

Review submissions containing HTML tags such as <script>, <img onerror=>, <svg onload=>, or JavaScript URI schemes in review body, author name, or metadata fields
Outbound requests from administrator browsers to unfamiliar domains shortly after viewing plugin-generated pages
Unexpected creation of WordPress administrator accounts or modifications to plugin and theme files following review activity
Content Security Policy (CSP) violation reports referencing inline script execution on pages rendered by Site Reviews

Detection Strategies

Inspect the WordPress database wp_posts and plugin-specific tables for review entries containing HTML or JavaScript syntax
Deploy Web Application Firewall (WAF) rules that flag HTML tags and event handlers submitted to Site Reviews endpoints
Correlate anonymous POST requests to review submission URLs with subsequent administrative session activity from unusual IP addresses
Enable and monitor CSP report-only headers to surface unexpected script execution on public-facing pages

Monitoring Recommendations

Log and alert on all HTTP requests to Site Reviews plugin routes, including query strings and POST bodies
Track WordPress user_meta and role changes to detect privilege modifications that follow XSS payload delivery
Review web server access logs for repeated submissions from single source addresses targeting review endpoints

How to Mitigate CVE-2026-73382

Immediate Actions Required

Update the Site Reviews plugin to a version above 8.2.0 as soon as a patched release is available from the vendor
Audit existing reviews for stored payloads and purge entries containing HTML or JavaScript content
Rotate WordPress administrator credentials and invalidate active sessions if suspicious review activity is present
Restrict access to review submission endpoints using a WAF or reverse-proxy rules until patched

Patch Information

Refer to the Patchstack advisory for the current patch status and fixed version guidance. Apply the vendor-supplied update through the WordPress plugin management interface once available.

Workarounds

Temporarily disable the Site Reviews plugin on production sites until a patched version is installed
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Configure the WAF to block requests containing <script, onerror=, onload=, and javascript: patterns targeting plugin endpoints
Require administrator review and approval of new submissions before public rendering

bash

# Example WAF rule (ModSecurity) to block XSS payloads on Site Reviews endpoints
SecRule REQUEST_URI "@contains /wp-content/plugins/site-reviews" \
    "chain,id:1002026,phase:2,deny,status:403,msg:'Potential XSS payload targeting Site Reviews plugin'"
SecRule ARGS "@rx (?i)(<script|onerror\s*=|onload\s*=|javascript:)" "t:none"