Show filters
91 Total Results
Displaying 71-80 of 91
Sort by:
Attacker Value
Unknown
CVE-2022-23979
Disclosure Date: January 06, 2022 (last updated February 23, 2025)
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability discovered in Ultimate Reviews WordPress plugin (versions <= 3.0.15).
0
Attacker Value
Unknown
CVE-2021-24973
Disclosure Date: January 03, 2022 (last updated February 23, 2025)
The Site Reviews WordPress plugin before 5.17.3 does not sanitise and escape the site-reviews parameter of the glsr_action AJAX action (available to unauthenticated and any authenticated users), allowing them to perform Cross-Site Scripting attacks against logged in admins viewing the Tool dashboard of the plugin
0
Attacker Value
Unknown
CVE-2021-24894
Disclosure Date: November 23, 2021 (last updated February 23, 2025)
The Reviews Plus WordPress plugin before 1.2.14 does not validate the submitted rating, allowing submission of long integer, causing a Denial of Service in the review section when an authenticated user submit such rating and the reviews are set to be displayed on the post/page
0
Attacker Value
Unknown
CVE-2021-24603
Disclosure Date: September 06, 2021 (last updated February 23, 2025)
The Site Reviews WordPress plugin before 5.13.1 does not sanitise some of its Review Details when adding a review as an admin, which could allow them to perform Cross-Site Scripting attacks when the unfiltered_html is disallowed
0
Attacker Value
Unknown
CVE-2021-24492
Disclosure Date: August 02, 2021 (last updated February 23, 2025)
The hndtst_action_instance_callback AJAX call of the Handsome Testimonials & Reviews WordPress plugin before 2.1.1, available to any authenticated users, does not sanitise, validate or escape the hndtst_previewShortcodeInstanceId POST parameter before using it in a SQL statement, leading to an SQL Injection issue.
0
Attacker Value
Unknown
CVE-2021-24296
Disclosure Date: May 24, 2021 (last updated February 22, 2025)
The WP Customer Reviews WordPress plugin before 3.5.6 did not sanitise some of its settings, allowing high privilege users such as administrators to set XSS payloads in them which will then be triggered in pages where reviews are enabled
0
Attacker Value
Unknown
CVE-2021-24135
Disclosure Date: March 18, 2021 (last updated February 22, 2025)
Unvalidated input and lack of output encoding in the WP Customer Reviews WordPress plugin, versions before 3.4.3, lead to multiple Stored Cross-Site Scripting vulnerabilities allowing remote attackers to inject arbitrary JavaScript code or HTML.
0
Attacker Value
Unknown
CVE-2019-16251
Disclosure Date: October 31, 2019 (last updated November 27, 2024)
plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.
0
Attacker Value
Unknown
CVE-2015-9526
Disclosure Date: October 23, 2019 (last updated February 08, 2025)
The Easy Digital Downloads (EDD) Reviews extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
0
Attacker Value
Unknown
CVE-2019-15560
Disclosure Date: August 26, 2019 (last updated November 27, 2024)
The Reviews Module before 2019-06-14 for OpenSource Table allows SQL injection in database/index.js.
0
