Skip to content
PluginCanary

WP Ultimate Review

by Roxnor · 60,000+ active installs · Checked 4 Nov 2026
Healthy

Healthy: maintained, last release 18 Oct 2026, 11 releases in 24 months, no unpatched vulnerabilities.

86/ 100 Canary Score
Sub-scores for WP Ultimate Review
Ownership100
Maintenance100
Security60
SupportNo data
ReputationNo data

How the score works

Quick answers

Is WP Ultimate Review still maintained?
Yes. Last release 18 Oct 2026, 11 releases in the last 24 months. 18 Oct 2026 · wordpress.org
Who owns WP Ultimate Review, and has it changed hands?
No change recorded. Main committer ataurr since May 2019. 4 Nov 2026 · SVN log
Was WP Ultimate Review removed from wordpress.org?
No. Listed on wordpress.org as of 4 Nov 2026. 4 Nov 2026 · wordpress.org
Is WP Ultimate Review safe?
17 known vulnerabilities, all fixed (latest in 2.4.5). Not on the exploited list. 20 Oct 2026 · Wordfence Intelligence
Is the latest WP Ultimate Review update safe to install?
No ownership change before 2.4.5. No one-star spike after it. 18 Oct 2026 · Release history

Active signals

Facts we detected, with links to the source.

No open risk signals. Signals appear here when we detect an ownership change, closure, vulnerability or decline.

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
plugin-master3 May 2019 to 3 May 2019, 1 commits
ataurr6 May 2019 to 18 Oct 2026, 73 commits

2 committers recorded. No ownership change since 2019.

Maintenance

Last release
17 days ago
Releases, 24 months
11
Tested up to
7.1 current
Requires PHP
7.4 supported 8.2+
Releases per quarter
Releases per quarter for WP Ultimate Review
Q1 20243
Q2 20241
Q3 20241
Q4 20241
Q1 20251
Q2 20250
Q3 20250
Q4 20251
Q1 20261
Q2 20262
Q3 20264
Q4 20261

Last release 18 Oct 2026. Tested with WordPress 7.1 (current).

Reputation

Last 90 days: no reviews. Lifetime: 3.4.

Average rating fell from 5.0 to 2.0 between Q3 2024 and Q1 2026.

Rating distribution
5 star8
4 star0
3 star4
2 star1
1 star4
Latest low reviews

Security record

10 vulnerabilities in 24 months (17 on record), all patched (latest fixed in 2.4.5).

Show 17 patched vulnerabilities
PublishedIssueCVSSAffectedFixed inDays to patch
20 Oct 2026Ultimate Review <= 2.4.4 - Unauthenticated Arbitrary Shortcode Execution6.5<= 2.4.42.4.5Patched before disclosure
2 Oct 2026WP Ultimate Review <= 2.4.3 - Unauthenticated Arbitrary Shortcode Execution via 'xs_reviw_summery' Parameter (Split-Shortcode / Late-Registered Shortcode)6.5<= 2.4.32.4.4Patched before disclosure
2 Oct 2026WP Ultimate Review <= 2.4.3 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_reviw_summery' Parameter5.4<= 2.4.32.4.4Patched before disclosure
1 Oct 2026Ultimate Review <= 2.4.3 - Unauthenticated Stored Cross-Site Scripting7.2<= 2.4.32.4.4Patched before disclosure
1 Oct 2026Ultimate Review <= 2.4.3 - Unauthenticated Persistent Denial of Service5.3<= 2.4.32.4.4Patched before disclosure
1 Oct 2026Ultimate Review <= 2.4.3 - Unauthenticated Persistent Page Denial of Service5.3<= 2.4.32.4.4Patched before disclosure
1 Oct 2026Ultimate Review <= 2.4.3 - Authenticated (Author+) Stored Cross-Site Scripting6.4<= 2.4.32.4.4Patched before disclosure
21 Sep 2026WP Ultimate Review <= 2.4.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_submit_review_data[xs_reviw_summery]' Parameter8.1<= 2.4.22.4.3Patched before disclosure
14 Feb 2026Ultimate Review <= 2.3.9 - Missing Authorization5.3<= 2.3.92.4.096
7 Dec 2025Ultimate Review <= 2.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 2.3.72.3.872
17 Apr 2024Wp Ultimate Review <= 2.2.5 - Missing Authorization5.3<= 2.2.52.3.0Patched before disclosure
17 Apr 2024Wp Ultimate Review <= 2.2.5 - Unauthenticated Review Restriction Bypass5.3<= 2.2.52.3.0Patched before disclosure
17 Apr 2024Wp Ultimate Review <= 2.2.5 - Unauthenticated Insecure Direct Object Reference5.3<= 2.2.52.3.0Patched before disclosure
5 Jan 2024Wp Ultimate Review <= 2.3.6 - IP Spoofing5.3<= 2.3.62.3.7720
16 Oct 2023Wp Ultimate Review <= 2.3.0 - Cross-Site Request Forgery via wur_settings_view4.3<= 2.2.42.3.1148
29 Mar 2023Wp Ultimate Review <= 2.0.3 - Cross-Site Request Forgery4.3<= 2.0.32.1.0Patched before disclosure
29 Mar 2023Wp Ultimate Review <= 2.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting4.4<= 2.0.32.1.0Patched before disclosure

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Support

100% of 1 support threads resolved in the last 2 months.

Momentum

60,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for WP Ultimate Review
4 May 20261,487
11 May 20264,314
18 May 202621,437
25 May 20267,444
1 Jun 20264,753
8 Jun 20264,120
15 Jun 20262,474
22 Jun 20261,714
29 Jun 20261,700
6 Jul 20261,319
13 Jul 20261,151
20 Jul 20261,134
27 Jul 20261,083
3 Aug 202621,064
10 Aug 202612,479
17 Aug 20262,649
24 Aug 20262,123
31 Aug 20262,072
7 Sep 20261,527
14 Sep 20268,961
21 Sep 202613,179
28 Sep 202617,176
5 Oct 20266,817
12 Oct 20269,914
19 Oct 20269,213
26 Oct 20266,021
2 Nov 2026380

Weekly downloads over the last 4 weeks are 3% above the 27-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.

TestimonialScore 100 · 20,000+Reviews and RatingScore 98 · 20,000+Real TestimonialsScore 94 · 40,000+WP Tripadvisor Review WidgetsScore 94 · 20,000+Reviews FeedScore 93 · 100,000+

Facts

Version2.4.5
AuthorRoxnor
Added6 May 2019
Last updated18 Oct 2026
Active installs60,000+
Requires WordPress6.0
Tested up to7.1.4
Requires PHP7.4
CategoryE-commerce & Shopping > Product Reviews & Ratings
Tagsuser review, rating plugin, service review, customer review, wordpress review plugin

Other plugins by this author: ElementsKit Elementor Addons - Advanced Widgets & Templates Addons for Elementor, MetForm - Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor, ShopEngine - All-in-One Elementor WooCommerce Builder with eCommerce Templates & Woo Widgets, GetGenie - AI SEO Assistant & Content Writer with Keyword Research, AEO & GEO, EmailKit - Email Customizer for WooCommerce & WP, Wp Social Login and Register Social Counter, Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers, TableKit - WordPress Table Builder for Data Tables, WooCommerce Product Tables & Post Tables, Dynamic Fields Engine - Custom post types, Custom fields, Meta fields, Taxonomies, Listing builder, Query builder and Relations, ShopEngine Gutenberg WooCommerce Builder Blocks Addon - All in One WooCommerce Solution, Rox Appointment Booking - Event, Calendar & Appointment Scheduling, FundEngine - Donation and Crowdfunding Platform

Questions

Is WP Ultimate Review still maintained?

Yes. Last release 18 Oct 2026, 11 releases in the last 24 months.

Who owns WP Ultimate Review, and has it changed hands?

No change recorded. Main committer ataurr since May 2019.

Was WP Ultimate Review removed from wordpress.org?

No. Listed on wordpress.org as of 4 Nov 2026.

Is WP Ultimate Review safe?

17 known vulnerabilities, all fixed (latest in 2.4.5). Not on the exploited list.

Is the latest WP Ultimate Review update safe to install?

No ownership change before 2.4.5. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 4 Nov 2026.Report a data issue