CVE-2021-24296

The WP Customer Reviews WordPress plugin before 3.5.6 did not sanitise some of its settings, allowing high privilege users such as administrators to set XSS payloads in them which will then be triggered in pages where reviews are enabled

CVSS v3.1

4.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0

3.5 LOWAV:N/AC:M/Au:S/C:N/I:P/A:N

EPSS

0.62% chance of exploitation in the next 30 days, 47th percentile

Published

2021-05-24

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/c450f54a-3372-49b2-8ad8-68d5cc0dd49e

References

• CVE Record
• NVD entry

Related

• CVE-2021-24295
• CVE-2021-24297
• CVE-2021-24294
• CVE-2021-24298
• CVE-2021-24293
• CVE-2021-24299