CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionNVD
The Site Reviews WordPress plugin before 7.2.5 does not properly sanitise and escape some of its Review fields, which could allow unauthenticated users to perform Stored XSS attacks
AnalysisAI
The Site Reviews WordPress plugin before version 7.2.5 contains a stored XSS vulnerability via review fields. Unauthenticated users can inject malicious scripts through review submissions that execute when administrators view the reviews in the dashboard, enabling admin session hijacking.
Technical ContextAI
Review fields submitted through the public review form are not properly sanitized before storage. When an administrator views reviews in the WordPress dashboard, the injected JavaScript executes in their authenticated browser session. This can steal admin cookies, create backdoor admin accounts, or modify site content.
RemediationAI
Update Site Reviews to 7.2.5 or later. Implement CSP headers that restrict inline script execution. Review stored reviews for suspicious script content. Enable HttpOnly flag on session cookies.
Share
External POC / Exploit Code
Leaving vuln.today