CVE-2021-24973

CWE-79 — Cross-site Scripting (XSS)3 documents3 sources
Severity
6.1MEDIUM
EPSS
4.4%
top 10.96%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Unknown Site ReviewsGeminilabs Site Reviews
Timeline
PublishedJan 3
Latest updateJan 4

Description

The Site Reviews WordPress plugin before 5.17.3 does not sanitise and escape the site-reviews parameter of the glsr_action AJAX action (available to unauthenticated and any authenticated users), allowing them to perform Cross-Site Scripting attacks against logged in admins viewing the Tool dashboard of the plugin

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

▶CVEListV5unknown/site_reviews5.17.3 — 5.17.3

Patches

Patch: plugins.trac.wordpress.org ↗Patch: plugins.trac.wordpress.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-4p7m-87rg-hcph: The Site Reviews WordPress plugin before 5↗2022-01-04
▶
CVEList
Site Reviews < 5.17.3 - Unauthenticated Stored Cross-Site Scripting↗2022-01-03
▶
CVE-2021-24973 (MEDIUM CVSS 6.1) | The Site Reviews WordPress plugin b | cvebase.io