Site Reviews
Monthly
Cross-site scripting in the Site Reviews WordPress plugin through version 8.3.1 allows unauthenticated remote attackers to inject script that executes in a victim's browser when the victim loads a page rendering the malicious content, with CVSS 3.1 scoring it 7.1 High due largely to scope change and unauthenticated reach. Exploitation requires user interaction (UI:R) and is most realistic on sites that accept untrusted or public review submissions or otherwise render attacker-controlled input to a privileged viewer, and there is no public exploit identified at time of analysis. Impact is limited to the browser context, such as session or credential theft and action forgery, rather than direct server compromise.
PHP object injection in the Site Reviews WordPress plugin before 8.3.0 allows unauthenticated remote attackers to deserialize arbitrary PHP objects on installations where the WordPress nonce key is absent, set to its sample/placeholder value, or too short to be secret. The plugin derives its deserialization protection key by padding the site's nonce key, making that derived key trivially computable under these common misconfiguration conditions. Exploitation impact is chained to PHP gadget chains present in other installed plugins or themes; no confirmed active exploitation (SSVC: none), but a public POC exists and full site compromise - including code execution, credential theft, and data loss - is achievable on sites with both a weak nonce key and a usable gadget chain.
Cross-site scripting in the Site Reviews WordPress plugin by Gemini Labs (versions up to and including 8.2.0) allows unauthenticated attackers to inject malicious JavaScript that executes in visitors' browsers when they view affected review pages. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) reflects that no authentication is needed to plant the payload, and the changed scope means the injected script can reach browser-origin resources beyond the plugin itself, enabling session hijacking or credential theft. No public exploit code or CISA KEV listing has been identified at time of analysis.
Missing authorization in Gemini Labs Site Reviews WordPress plugin through 8.3.2 lets unauthenticated remote attackers trigger an improperly access-controlled action, potentially modifying site data with limited integrity-only impact; confidentiality and availability are not affected per the assessed CVSS vector. The flaw is CWE-862 and requires no authentication, no user interaction, and no special privileges in default configurations, making it remotely reachable on sites where the plugin is active. No public exploit or confirmed active exploitation is indicated by the available data, and no fixed version is named in the provided intelligence; Patchstack reported the issue.
The Site Reviews WordPress plugin before version 7.2.5 contains a stored XSS vulnerability via review fields. Unauthenticated users can inject malicious scripts through review submissions that execute when administrators view the reviews in the dashboard, enabling admin session hijacking.
The Site Reviews WordPress plugin before 7.0.0 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability in Gemini Labs Site Reviews site-reviews.2.0. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Site Reviews WordPress plugin before 6.7.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Site Reviews WordPress plugin before 5.13.1 does not sanitise some of its Review Details when adding a review as an admin, which could allow them to perform Cross-Site Scripting attacks when the. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Cross-site scripting vulnerability in Site Reviews versions prior to 2.15.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-site scripting in the Site Reviews WordPress plugin through version 8.3.1 allows unauthenticated remote attackers to inject script that executes in a victim's browser when the victim loads a page rendering the malicious content, with CVSS 3.1 scoring it 7.1 High due largely to scope change and unauthenticated reach. Exploitation requires user interaction (UI:R) and is most realistic on sites that accept untrusted or public review submissions or otherwise render attacker-controlled input to a privileged viewer, and there is no public exploit identified at time of analysis. Impact is limited to the browser context, such as session or credential theft and action forgery, rather than direct server compromise.
PHP object injection in the Site Reviews WordPress plugin before 8.3.0 allows unauthenticated remote attackers to deserialize arbitrary PHP objects on installations where the WordPress nonce key is absent, set to its sample/placeholder value, or too short to be secret. The plugin derives its deserialization protection key by padding the site's nonce key, making that derived key trivially computable under these common misconfiguration conditions. Exploitation impact is chained to PHP gadget chains present in other installed plugins or themes; no confirmed active exploitation (SSVC: none), but a public POC exists and full site compromise - including code execution, credential theft, and data loss - is achievable on sites with both a weak nonce key and a usable gadget chain.
Cross-site scripting in the Site Reviews WordPress plugin by Gemini Labs (versions up to and including 8.2.0) allows unauthenticated attackers to inject malicious JavaScript that executes in visitors' browsers when they view affected review pages. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) reflects that no authentication is needed to plant the payload, and the changed scope means the injected script can reach browser-origin resources beyond the plugin itself, enabling session hijacking or credential theft. No public exploit code or CISA KEV listing has been identified at time of analysis.
Missing authorization in Gemini Labs Site Reviews WordPress plugin through 8.3.2 lets unauthenticated remote attackers trigger an improperly access-controlled action, potentially modifying site data with limited integrity-only impact; confidentiality and availability are not affected per the assessed CVSS vector. The flaw is CWE-862 and requires no authentication, no user interaction, and no special privileges in default configurations, making it remotely reachable on sites where the plugin is active. No public exploit or confirmed active exploitation is indicated by the available data, and no fixed version is named in the provided intelligence; Patchstack reported the issue.
The Site Reviews WordPress plugin before version 7.2.5 contains a stored XSS vulnerability via review fields. Unauthenticated users can inject malicious scripts through review submissions that execute when administrators view the reviews in the dashboard, enabling admin session hijacking.
The Site Reviews WordPress plugin before 7.0.0 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability in Gemini Labs Site Reviews site-reviews.2.0. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Site Reviews WordPress plugin before 6.7.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Site Reviews WordPress plugin before 5.13.1 does not sanitise some of its Review Details when adding a review as an admin, which could allow them to perform Cross-Site Scripting attacks when the. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Cross-site scripting vulnerability in Site Reviews versions prior to 2.15.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.