Vulnerability · Published Jan 3, 2022 · Assigned by WPScan
CVE-2021-24973Site Reviews < 5.17.3 - Unauthenticated Stored Cross-Site Scripting
Medium 6.1
In plain English
A medium-severity cross-site scripting in Site Reviews from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities).
Severity (CVSS NVD)6.1Medium
Exploit odds (30 days)1.3%top 28.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The Site Reviews WordPress plugin before 5.17.3 does not sanitise and escape the site-reviews parameter of the glsr_action AJAX action (available to unauthenticated and any authenticated users), allowing them to perform Cross-Site Scripting attacks against logged in admins viewing the Tool dashboard of the plugin
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Site Reviews | 5.17.3 – before 5.17.3 |
Weakness: CWE-79
References
- https://wpscan.com/vulnerability/0118f245-0e6f-44c1-9bdb-5b3a5d2403d6 x_refsource_MISC
- https://plugins.trac.wordpress.org/changeset/2629821 x_refsource_CONFIRM