CVE-2026-94377— Verified Reviews (Avis Vérifiés) <= 2.4.6 - Unauthenticated Stored Cross-Site Scripting via 'moderation' Parameter (discussion.commentaire)
Quick assessment
Affected
avisverifies Verified Reviews (Avis Vérifiés)
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress 的“Verified Reviews”（Avis Vérifiés）插件在所有 2.4.6 及以下版本中存在存储型跨站脚本（Stored XSS）漏洞，原因是缺乏适当的输入清理和输出转义。这使得未经身份验证的攻击者可以在页面中注入任意 Web 脚本，当其他用户访问被注入内容的页面时，这些脚本就会执行。 该身份验证绕过漏洞之所以能够成功，是因为 函数在验证签名时使用了松散的 比较操作。攻击者可以构造一个 JSON 请求体，将 和 字段设置为布尔值 ，从而绕过所有配置检查，成功通过验证。
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| avisverifies | Verified Reviews (Avis Vérifiés) | ≤ 2.4.6 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-94377
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Verified Reviews (Avis Vérifiés) <= 2.4.6 - Unauthenticated Stored Cross-Site Scripting via 'moderation' Parameter (discussion.commentaire)
Source: CVE Program / CVE List V5
Vulnerability Description
The Verified Reviews (Avis Vérifiés) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'moderation' parameter in all versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The authentication bypass is possible because ntav_check_data() uses loose != comparisons for signature verification, allowing a JSON body with boolean true values for idWebsite and sign to pass all checks on any configured installation.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| avisverifies | Verified Reviews (Avis Vérifiés) | 0 ~ 2.4.6 | - |
|
II. Public POCs for CVE-2026-94377
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-94377
请登录查看更多情报信息。
Other References for CVE-2026-94377 (2)
IV. Related Vulnerabilities
Same weakness: CWE-79
-
CVE-2026-78087
VK Blocks <= 1.126.1 - Authenticated (Contributor+) Stored C -
CVE-2026-15180
Tracking Code Manager <= 2.6.0 - Reflected Cross-Site Script -
CVE-2026-88043
Mang Board WP <= 2.4.0 - Unauthenticated Stored Cross-Site S -
CVE-2026-18548
Groundhogg <= 4.5.14 - Unauthenticated Stored Cross-Site Scr -
CVE-2026-18586
Premium Packages <= 7.0.5 - Unauthenticated Stored Cross-Sit
V. Comments for CVE-2026-94377
No comments yet