CVE-2025-10734
Medium · 5.3CVSS
5.3
EPSS
0.2%
Published
Mar 23, 2026
CISA due date
—
The record
The ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.12 via the syncedData function. This makes it possible for unauthenticated attackers to extract sensitive data including user names, emails, phone numbers, addresses.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-87951 Insecure Storage of Sensitive Information vulnerability in Drupal SAML SSO - Service… CWE-922
- CVE-2026-44629 Improper access control to the Synergis Softwire installation folder. CWE-922
- CVE-2026-20705 Insecure storage of sensitive information in the Intel(R) TDX module for some Intel(R)… CWE-922
- CVE-2026-47362 In versions of the Datadog Android application prior to v554-5.9.4, two Room-backed… CWE-922
- CVE-2026-46511 HAX CMS helps manage microsite universe with PHP or NodeJs backends. CWE-922
- CVE-2026-5515 IBM App Connect Enterprise 13.0.1.0 through 13.0.7.0 stores potentially sensitive… CWE-922
- GHSA-x3x5-7h4h-gwxg HAXcms: Mass Token Exfiltration and Cross-Tenant Hijack CWE-922
- CVE-2026-7257 ** UNSUPPORTED WHEN ASSIGNED ** An insecure storage of sensitive information… CWE-922