Remoji – Post/Comment Reaction and Enhancement

Remoji – Post/Comment Reaction and Enhancement has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of September 2026. Their average CVSS score is 7.2, and the most serious one scores 7.2 out of 10. Severity breakdown: 0 critical and 1 high.

The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).

The one issue recorded for Remoji – Post/Comment Reaction and Enhancement has a vendor fix available, so running the current release closes it.

All of these findings were reported by Doan Dinh Van (d52v). Remoji – Post/Comment Reaction and Enhancement is installed on roughly 300 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

Strategic Overview

Avg CVSSHigh

7.2/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Remoji – Post/Comment Reaction and Enhancement vulnerabilities before they are exploited.

Highest severity on recordCVSS 7.2CVE-2026-25452

Remoji – Post/Comment Reaction and Enhancement <= 2.2 - Unauthenticated Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

1 records


2026-03-17 00:00	Remoji – Post/Comment Reaction and Enhancement <= 2.2 - Unauthenticated Stored Cross-Site Scripting Remoji <= 2.2	`CVE-2026-25452`	7.2 High	Doan Dinh Van (d52v)	Yes

Showing 1–1 of 1 reports

Latestv2.6

Remoji – Post/Comment Reaction and Enhancement

Author

WPDO

5.0(5)

100/100

Last Updated

2026-07-07 (2mo ago)

Active Installs

300+

Downloads

13,431

Requires WP

4.4+

Requires PHP

Tested up to

WP 7.0.4

Created

2020-05-05 (6y ago)

Add the slack style emoji to posts, pages or comments. Features: React with emojis to any post or comment. Post View counter. Compatible with all cache plugins! Easy to use. Automatically exclude bots. Disable comment on any post type (pages, posts, attachments). Most Viewed widget. Recent Reacted Emoji Post widget. Allow guests reaction or logged-in user reaction only. GDPR compliant. With this feature turned on, all logged IPs get obfuscated (md5-hashed). Post View Edit wp-content/themes/<YOUR THEME>/index.php or archive.php/single.php/post.php/page.php. In the loop while ( have_posts() ) { or anywhere you want to show the views, add the following codes: do_action( 'remoji_postview' );. API To show postview in themes/plugins, use do_action( 'remoji_postview', $the_post_id_to_inquire );. Shortcode [views] available Use [views] or [views id="3"](To show the views of post ID 3) in your editor.

View on WordPress.org