CVE-2025-10734

MEDIUM

ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More <= 2.2.12 - Unauthenticated Sensitive Information Exposure

Title source: cna
STIX 2.1

Description

The ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.12 via the syncedData function. This makes it possible for unauthenticated attackers to extract sensitive data including user names, emails, phone numbers, addresses.

References (2)

Scores

CVSS v3 5.3
EPSS 0.0004
EPSS Percentile 12.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-922
Status published
Products (1)
reviewx/ReviewX – Multi-Criteria Reviews for WooCommerce with Google Reviews & Schema < 2.2.12
Published Mar 23, 2026
Tracked Since Mar 23, 2026