Not rated
CVE-2021-24973 The Site Reviews WordPress plugin before 5.17.3 does not sanitise and escape the site-reviews parameter of the…
Description
The Site Reviews WordPress plugin before 5.17.3 does not sanitise and escape the site-reviews parameter of the glsr_action AJAX action (available to unauthenticated and any authenticated users), allowing them to perform Cross-Site Scripting attacks against logged in admins viewing the Tool dashboard of the plugin
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Site Reviews 5.17 | earliest → < 5.17.3 | 5.17.3 |
Other CVEs of Site Reviews
The 6 CVEs of Site Reviews →
CVE-2026-82925
The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized, and derives the…
8.1
High
CVE-2025-1232
The Site Reviews WordPress plugin before 7.2.5 does not properly sanitise and escape some of its Review fields, which…
8.8
High
CVE-2024-3050
The Site Reviews WordPress plugin before 7.0.0 retrieves client IP addresses from potentially untrusted headers,…
9.1
Critical
CVE-2023-1525
The Site Reviews WordPress plugin before 6.7.1 does not sanitise and escape some of its settings, which could allow high…
4.8
Medium