CVE-2026-73382
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
Stored XSS vulnerability in the Site Reviews plugin by Gemini Labs. Improper input neutralization during web page generation allows persistent script injection. Affects versions from n/a through 8.2.0.
Risk Assessment
An attacker can inject a malicious script that executes in the browser of an administrator or other users, potentially leading to session theft, account takeover, or content modification.
Recommendation
Immediately update the Site Reviews plugin to a version newer than 8.2.0 where the vulnerability is fixed. Also review existing content for injected scripts.
Other vulnerabilities in Site Reviews
See all- CVE-2026-118087Medium
The Site Reviews plugin by Gemini Labs (up to version 8.3.5) has a Cross-site Scripting (Stored XSS) vulnerability due to improper neutralization of input during web page generation.
- CVE-2026-103340Medium
Site Reviews plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control levels. Affects versions up to 8.3.2.
- CVE-2026-94078High
The Site Reviews plugin in versions <= 8.3.1 is vulnerable to unauthenticated Cross Site Scripting (XSS). An unauthenticated attacker can inject malicious script.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gemini Labs Site Reviews site-reviews allows Stored XSS.This issue affects Site Reviews: from n/a through 8.2.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS