Review Stream
Review Stream has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2025; all 2 are fixed as of September 2026. Their average CVSS score is 4.4, and the most serious one scores 4.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 2 of the records (100%).
Every one of the 2 issues recorded for Review Stream has a vendor fix available, so running the current release closes all known holes.
2 independent researchers contributed these findings, one record each. Review Stream is installed on roughly 400 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.8.8.
CVE-2025-32680Review Stream <= 1.6.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records
Review Stream
Author
Grade Us, Inc.
To use this plugin, you must: have a Grade.us account with review monitoring enabled be approved for API access and know your API token add the [reviewstream] shortcode to your WordPress site have your server’s SSL certificate file up to date (cacert.pem) (see https://stackoverflow.com/a/21114601 for a possible solution) Release Notes 1.6.8 (2025-04-30) Security update 1.6.7 (2023-08-30) Bugfixes 1.6.6 (2023-06-27) Security update Update WP compatibility version 1.6.5 (2022-10-19) Update WP compatibility version 1.6.4 (2020-12-01) Fix pagination issues 1.6.3 (2020-06-22) Drop RDFa and Micro Data schema formats JSON-LD is the default schema option (Rich Results) HTTPS on all URLs Reduce cache validity to 3 hours 1.6.2 (2019-09-20) Removed the option to see reviews randomly. 1.6.1 (2019-09-12) style improvements 1.6.0 (2019-06-14) Added json-ld schema type 1.5.3 (2017-09-26) Updates for PHP 7 compatibility. 1.5.2 (2017-04-30) Minor markup changes for accessibility. 1.5.1 (2017-02-27) Schema logic changes to keep up with the Google. 1.5 (2017-01-22) Added image to LocalBusiness schema wrapper. 1.4 (2016-12-21) Added pagination option to list view. 1.3 (2016-11-15) Modifying dates to a universal format. 1.2 (2016-10-04) Added missing templates into WordPress.org version control. 1.1 (2016-09-11) Added additional config option to reviewstream default and shortcode: stream_only 1.0 (2016-08-30) Added support for selective use of schema. 0.171 (2016-08-12) Added new admin messaging and put readme in reverse chronological! 0.17 (2016-08-10) Moved config file to reviewstream-settings directory in uploads. Added config option last_initial to show only the last initial of reviewer’s name. 0.16 (2016-06-28) Added config option include_empty to allow filtering of empty reviews. 0.15 (2016-04-28) Updated review limit and modified templates to show links only when present. 0.14 (2016-02-25) Updated aggregate star display logic to better handle decimal ratings. 0.13 (2016-01-22) Added namespace to plugin_settings_link declaration to avoid conflicts. 0.12 (2016-01-14) Added additional config options to reviewstream shortcode: display, randomize 0.11 (2015-07-24) Adding additional config options to reviewstream shortcode: show_aggregate_rating, show_reviews, show_powered_by 0.1 (2015-04-01) No fooling! This is an alpha release for select users.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C