HomeWordPress vulnerabilitiesReviewX
ReviewX vulnerabilities
ReviewX has 7 known vulnerabilities in this database. The most recent published record is dated 23 Mar 2026.
- Known vulnerabilities
- 7
- Active installs
- 7,000+
- Latest version
- 2.5.1
- Last updated
- 31 Aug 2026
- Most recent
- 23 Mar 2026
Find it in your WordPress dashboard under Plugins. Severity is based on the CVSS score published with the CVE where one is available.
| Vulnerability | Severity | Affected | Fix | Published |
|---|---|---|---|---|
| Sensitive data exposure CVE-2025-10731 | Medium 5.3 | Up to 2.2.12 | Fixed in a later version (latest 2.5.1) | 23 Mar 2026 |
| Sensitive data exposure CVE-2025-10734 | Medium 5.3 | Up to 2.2.12 | Fixed in a later version (latest 2.5.1) | 23 Mar 2026 |
| Remote code execution CVE-2025-10679 | High 7.3 | Up to 2.2.12 | Fixed in a later version (latest 2.5.1) | 23 Mar 2026 |
| Broken access control CVE-2025-10736 | Medium 6.5 | Up to 2.2.10 | Fixed in a later version (latest 2.5.1) | 23 Mar 2026 |
| Broken access control CVE-2024-3609 | Medium 4.3 | Before 1.6.28 | Fixed in 1.6.28 | 16 May 2024 |
| Privilege escalation CVE-2023-2833 | High 8.8 | Up to 1.6.13 | Fixed in a later version (latest 2.5.1) | 6 Jun 2023 |
| SQL injection CVE-2023-26325 | High 8.8 | Before 1.6.4 | Fixed in 1.6.4 | 23 Feb 2023 |
Read the published descriptions
- CVE-2025-10731, 23 Mar 2026
- The ReviewX - WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.12 via the allReminderSettings function. This makes it possible for unauthenticated attackers to obtain authentication tokens and subsequently bypass admin restrictions to access and export sensitive data including order details, names, emails, addresses, phone numbers, and user information. CVE record
- CVE-2025-10734, 23 Mar 2026
- The ReviewX - WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.12 via the syncedData function. This makes it possible for unauthenticated attackers to extract sensitive data including user names, emails, phone numbers, addresses. CVE record
- CVE-2025-10679, 23 Mar 2026
- The ReviewX - WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More plugin for WordPress is vulnerable to arbitrary method calls in all versions up to, and including, 2.2.12. This is due to insufficient input validation in the bulkTenReviews function that allows user-controlled data to be passed directly to a variable function call mechanism. This makes it possible for unauthenticated attackers to call arbitrary PHP class methods that take no inputs or have default values, potentially leading to information disclosure or remote code execution depending on available methods and server configuration. CVE record
- CVE-2025-10736, 23 Mar 2026
- The ReviewX - WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More plugin for WordPress is vulnerable to unauthorized access of data due to improper authorization checks on the userAccessibility() function in all versions up to, and including, 2.2.10. This makes it possible for unauthenticated attackers to access protected REST API endpoints, extract and modify information related to users and plugin's configuration CVE record
- CVE-2024-3609, 16 May 2024
- The ReviewX - Multi-criteria Rating & Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized deletion of data due to a missing capability check on the reviewx_remove_guest_image function in all versions up to, and including, 1.6.27. This makes it possible for authenticated attackers, with subscriber access and above, to delete attachments. CVE record
- CVE-2023-2833, 6 Jun 2023
- The ReviewX plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.6.13 due to insufficient restriction on the 'rx_set_screen_options' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role by supplying the 'wp_screen_options[option]' and 'wp_screen_options[value]' parameters during a screen option update. CVE record
- CVE-2023-26325, 23 Feb 2023
- The 'rx_export_review' action in the ReviewX WordPress Plugin, is affected by an authenticated SQL injection vulnerability in the 'filterValue' and 'selectedColumns' parameters. CVE record
What to do if you run ReviewX
If you run ReviewX, open WordPress and check the installed version in Plugins. Compare it with the affected versions in the vulnerability record. If a fixed version is available, take a current backup and update to that version or the latest supported release.
If no fixed version exists, consider disabling and removing the plugin or replacing it with a maintained alternative. After dealing with the affected software, check administrator users, unexpected file changes, redirects, unfamiliar pages and security logs for signs that the site may already have been altered.
Email me about new ReviewX vulnerabilities
Free. We email you when a new vulnerability is published for ReviewX, usually within minutes. Confirm by email; unsubscribe any time.
Focus on your business. We’ll take care of your website.
From everyday updates to ongoing care, we keep your website working.