Site Reviews < 5.17.3 - Unauthenticated Stored Cross-Site Scripting

The plugin does not sanitise and escape the site-reviews parameter of the glsraction AJAX action available to unauthenticated and any authenticated users, allowing them to perform Cross-Site Scripting attacks against logged in admins viewing the Tool dashboard of the plugin...

WordPress Rich Reviews plugin <= 1.9.5 - SQL Injection (SQLi) vulnerability

SQL Injection SQLi vulnerability discovered by bl4derunner in WordPress Rich Reviews plugin versions = 1.9.5. Solution Update the WordPress Rich Reviews plugin to the latest available version at least 1.9.6...

Rich Reviews by Starfish < 1.9.6 - Admin+ SQL Injection

The plugin does not properly validate the orderby GET parameter of the pending reviews page before using it in a SQL statement, leading to an authenticated SQL injection issue error-based SQLI: orderby=id AND EXTRACTVALUE4795,CONCAT0x5c,0x717a627871,SELECT ELT4795=4795,1,0x7176707071 time-based...

CVE-2021-24894

The Reviews Plus WordPress plugin before 1.2.14 does not validate the submitted rating, allowing submission of long integer, causing a Denial of Service in the review section when an authenticated user submit such rating and the reviews are set to be displayed on the post/page...

CVE-2021-24894

The Reviews Plus WordPress plugin before 1.2.14 does not validate the submitted rating, allowing submission of long integer, causing a Denial of Service in the review section when an authenticated user submit such rating and the reviews are set to be displayed on the post/page...

CVE-2021-24894

The Reviews Plus WordPress plugin before 1.2.14 does not validate the submitted rating, allowing submission of long integer, causing a Denial of Service in the review section when an authenticated user submit such rating and the reviews are set to be displayed on the post/page...

PT-2021-16358 · WordPress · Reviews Plus

Name of the Vulnerable Software and Affected Versions: Reviews Plus WordPress plugin versions prior to 1.2.14 Description: The issue allows submission of a long integer as a rating, causing a Denial of Service in the review section when an authenticated user submits such a rating and the reviews...

WordPress plugin Reviews Plus 输入验证错误漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. An input validation error vulnerability...

Judge.me : Stored XSS in Public Profile Reviews

A stored XSS vulnerability was found in the public profile review section of a platform. Attackers could add a product description with a data URI XSS payload in HTML format, which would execute when a user clicked on the HTML tag. This could lead to the execution of arbitrary code in the victim'...

Reviews Plus < 1.2.14 - Subscriber+ Reviews DoS

The plugin does not validate the submitted rating, allowing submission of long integer, causing a Denial of Service in the review section when an authenticated user submit such rating and the reviews are set to be displayed on the post/page Enable reviews for post/pages, and enable the "Show...

WordPress Reviews Plus plugin <= 1.2.13 - Reviews Denial of Service (DoS) vulnerability

Reviews Denial of Service DoS vulnerability discovered by Drew Jones in WordPress Reviews Plus plugin versions = 1.2.13. Solution Update the WordPress Reviews Plus plugin to the latest available version at least 1.2.14...

WordPress plugin Site Reviews cross-site scripting vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on PHP and MySQL servers. cross-site scripting vulnerability exists in versions of the WordPress plugin Site Reviews prior to 5.13....

CVE-2021-24603

The Site Reviews WordPress plugin before 5.13.1 does not sanitise some of its Review Details when adding a review as an admin, which could allow them to perform Cross-Site Scripting attacks when the unfilteredhtml is disallowed...

CVE-2021-24603

The Site Reviews WordPress plugin before 5.13.1 does not sanitise some of its Review Details when adding a review as an admin, which could allow them to perform Cross-Site Scripting attacks when the unfilteredhtml is disallowed...

CVE-2021-24603 Site Reviews < 5.13.1 - Authenticated Stored XSS

The Site Reviews WordPress plugin before 5.13.1 does not sanitise some of its Review Details when adding a review as an admin, which could allow them to perform Cross-Site Scripting attacks when the unfilteredhtml is disallowed...

CVE-2021-24603

CVE-2021-24603 affects the WordPress Site Reviews plugin (before 5.13.1). The vulnerability is an authenticated stored XSS due to insufficient sanitisation of Review Details added by admins, which can be triggered when unfiltered_html is disallowed. The issue is exploitable by authenticated attac...

WordPress 插件跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on PHP and MySQL servers. cross-site scripting vulnerability exists in versions of the WordPress plugin Site Reviews prior to 5.13....

Manipulation of product reviews via API

Impact Manipulation of product reviews via API Patches We recommend updating to the current version 6.4.3.1. You can get the update to 6.4.3.1 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/download/shopware-6 Workarounds For older versions of 6....

GHSA-9F8F-574Q-8JMF Manipulation of product reviews via API

Impact Manipulation of product reviews via API Patches We recommend updating to the current version 6.4.3.1. You can get the update to 6.4.3.1 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/download/shopware-6 Workarounds For older versions of 6....

CVE-2021-37707

Shopware is an open source eCommerce platform. Versions prior to 6.4.3.1 contain a vulnerability that allows manipulation of product reviews via API. Version 6.4.3.1 contains a patch. As workarounds for older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a...