Site Reviews < 7.2.5 - Unauthenticated Stored XSS

Site Reviews WordPress plugin before 7.2.5 contains a stored cross-site scripting caused by improper sanitization and escaping of review fields, letting unauthenticated users execute malicious scripts, exploit requires no authentication. id: CVE-2025-1232 info: name: Site Reviews 7.2.5 -...

CVE-2026-103340

Missing Authorization vulnerability in Gemini Labs Site Reviews site-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Site Reviews: from n/a through 8.3.2...

CVE-2026-103340

The Gemini Labs Site Reviews WordPress plugin versions

EUVD-2026-90794

Missing Authorization vulnerability in Gemini Labs Site Reviews site-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Site Reviews: from n/a through 8.3.2...

CVE-2026-103340 WordPress Site Reviews plugin <= 8.3.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Gemini Labs Site Reviews site-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Site Reviews: from n/a through 8.3.2...

CVE-2026-103340 WordPress Site Reviews plugin <= 8.3.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Gemini Labs Site Reviews site-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Site Reviews: from n/a through 8.3.2...

WordPress Site Reviews plugin <= 8.3.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Thaer Assfour in WordPress Plugin Site Reviews versions = 8.3.2...

CVE-2026-94078

Unauthenticated Cross Site Scripting XSS in Site Reviews = 8.3.1 versions...

CVE-2026-94078 WordPress Site Reviews plugin <= 8.3.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Site Reviews = 8.3.1 versions...

CVE-2026-94078

The Site Reviews WordPress plugin, affecting versions

EUVD-2026-89833

Unauthenticated Cross Site Scripting XSS in Site Reviews = 8.3.1 versions...

CVE-2026-94078 WordPress Site Reviews plugin <= 8.3.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Site Reviews = 8.3.1 versions...

WordPress Site Reviews plugin <= 8.3.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Intrudify in WordPress Plugin Site Reviews versions = 8.3.1...

WordPress Site Reviews plugin 7.2.2-8.2.2 - Unauthenticated PHP Object Injection vulnerability

Unauthenticated PHP Object Injection vulnerability discovered by Jakub Herman in WordPress Plugin Site Reviews versions 7.2.2-8.2.2...

CVE-2026-82925

The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized, and derives the key protecting that data by padding out the site's WordPress nonce key, which makes the key publicly computable on installs where that key is absent, left at its sample value, or...

CVE-2026-82925

The Site Reviews WordPress plugin (versions before 8.3.0 ) is vulnerable to an unauthenticated PHP object injection due to improper handling of request data deserialization. The plugin derives a protection key by padding the site's WordPress nonce key; if this key is absent, left at a sample valu...

CVE-2026-82925 Site Reviews 7.2.2 - 8.2.2 - Unauthenticated PHP Object Injection via Form Signature

The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized, and derives the key protecting that data by padding out the site's WordPress nonce key, which makes the key publicly computable on installs where that key is absent, left at its sample value, or...

EUVD-2026-75267

The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized, and derives the key protecting that data by padding out the site's WordPress nonce key, which makes the key publicly computable on installs where that key is absent, left at its sample value, or...

CVE-2026-82925 Site Reviews 7.2.2 - 8.2.2 - Unauthenticated PHP Object Injection via Form Signature

The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized, and derives the key protecting that data by padding out the site's WordPress nonce key, which makes the key publicly computable on installs where that key is absent, left at its sample value, or...

CVE-2026-82925: Deserialization of Untrusted Data

The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized, and derives the key protecting that data by padding out the site's WordPress nonce key, which makes the key publicly computable on installs where that key is absent, left at its sample value, or...