WP Vulnerability WatchVulnerability data as of September 7, 2026

Known vulnerabilities in ReviewX – Multi-Criteria Reviews for WooCommerce with Google Reviews & Schema

Drive woocommerce business growth with social proof: gather product reviews with multicriteria ratings, auto-reminder emails, discounts, and more.

15Reported vulnerabilities
8.8Highest CVSS score
2.5.0Latest version
7,000+Active installs

What to do now

Update ReviewX – Multi-Criteria Reviews for WooCommerce with Google Reviews & Schema to 2.3.11 or later. 15 of these have a fixed version available. Updating resolves them.

Plugin last updated: July 29, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVESeverityExploit probability
next 30 days		 Affected versionsFixed inPublished
CVE-2023-2833 High 8.8 17.5% 1.6.13 and earlier 1.6.14 June 6, 2023
CVE-2023-26325 High 8.8 0.9% Before 1.6.4 1.6.4 February 23, 2023
WF-6c3032ae-eb86-47d0-b160-320a67a380e1 High 8.3 — Before 1.2.9 1.2.9 June 30, 2021
CVE-2026-57359 High 7.2 0.3% 2.3.10 and earlier 2.3.11 July 1, 2026
CVE-2025-10679 High 7.3 0.4% 0 to 2.2.12 (inclusive) 2.3.0 March 23, 2026
CVE-2022-46809 Medium 6.5 0.8% 1.6.7 and earlier 1.6.8 April 13, 2023
CVE-2025-10736 Medium 6.5 0.2% 0 to 2.2.10 (inclusive) 2.2.12 March 23, 2026
CVE-2024-29812 Medium 6.4 0.4% 1.6.22 and earlier 1.6.23 March 25, 2024
CVE-2026-40781 Medium 5.3 0.3% 2.3.6 and earlier 2.3.7 April 22, 2026
CVE-2025-10734 Medium 5.3 0.2% 0 to 2.2.12 (inclusive) 2.3.0 March 23, 2026
CVE-2025-10731 Medium 5.3 0.3% 0 to 2.2.12 (inclusive) 2.3.0 March 23, 2026
CVE-2024-43323 Medium 5.3 0.5% 1.6.28 and earlier 1.6.29 August 16, 2024
CVE-2024-3609 Medium 4.3 0.4% Before 1.6.28 1.6.28 May 16, 2024
CVE-2024-33921 Medium 4.3 0.4% 1.6.21 and earlier 1.6.22 April 29, 2024
CVE-2023-40670 Medium 4.3 0.5% 1.6.17 and earlier 1.6.18 August 22, 2023

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.