Non notée
CVE-2021-24973 The Site Reviews WordPress plugin before 5.17.3 does not sanitise and escape the site-reviews parameter of the…
Description
The Site Reviews WordPress plugin before 5.17.3 does not sanitise and escape the site-reviews parameter of the glsr_action AJAX action (available to unauthenticated and any authenticated users), allowing them to perform Cross-Site Scripting attacks against logged in admins viewing the Tool dashboard of the plugin
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Site Reviews 5.17 | premières → < 5.17.3 | 5.17.3 |
Autres CVE de Site Reviews
Les 6 CVE de Site Reviews →
CVE-2026-82925
The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized, and derives the…
8.1
Élevée
CVE-2025-1232
The Site Reviews WordPress plugin before 7.2.5 does not properly sanitise and escape some of its Review fields, which…
8.8
Élevée
CVE-2024-3050
The Site Reviews WordPress plugin before 7.0.0 retrieves client IP addresses from potentially untrusted headers,…
9.1
Critique
CVE-2023-1525
The Site Reviews WordPress plugin before 6.7.1 does not sanitise and escape some of its settings, which could allow high…
4.8
Moyenne