WP Customer Reviews < 3.5.6 - Authenticated Stored Cross-Site Scripting (XSS)
Priority LOW 23CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.
Summary
The WP Customer Reviews WordPress plugin before 3.5.6 did not sanitise some of its settings, allowing high privilege users such as administrators to set XSS payloads in them which will then be triggered in pages where reviews are enabled
Why it matters now
EPSS 0.00617 49th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed WP Customer Reviews (Go Web Solutions): 3.5.6
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Go Web Solutions | WP Customer Reviews | 3.5.6 to before 3.5.6 | 3.5.6 | Patch available | CNA |
- WP Customer Reviews VendorGo Web Solutions Affected 3.5.6 to before 3.5.6 Fixed in 3.5.6 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:gowebsolutions:wp_customer_reviews:*:*:*:*:*:wordpress:*:* | before 3.5.6 | Vulnerable | Go Web Solutions |
- cpe:2.3:a:gowebsolutions:wp_customer_reviews:*:*:*:*:*:wordpress:*:* Versions before 3.5.6 Vulnerable ·Go Web Solutions
Remediation
- Fix · CNA WP Customer Reviews (Go Web Solutions) Fixed in 3.5.6
Timeline
- 2026-10-02 Threatist record created from CVE-2021-24296
- 2026-10-03 Alias added: GHSA-r7g7-h9q3-437j
References
More Go Web Solutions Wp Customer Reviews vulnerabilities
- TI-2024-01721 WP Customer Reviews < 3.7.1 - Malicious Redirect via HTTP-EQUIV Injection CVSS 3.1MEDIUM 5.4
- TI-2016-08940 The wp-customer-reviews plugin before 3.0.9 for WordPress has CSRF in the admin tools. CVSS 3.0HIGH 8.8
- TI-2021-06427 WP Customer Reviews < 3.4.3 - Multiple Unauthenticated and Low Priv Authenticated Stored XSS CVSS 3.1MEDIUM 6.1
- TI-2016-08939 The wp-customer-reviews plugin before 3.0.9 for WordPress has XSS in the admin tools. CVSS 3.0MEDIUM 6.1
- TI-2023-04284 WP Customer Reviews <= 3.6.6 - Authenticated (Administrator+) Stored Cross-Site Scripting CVSS 3.1MEDIUM 4.8
- TI-2023-04318 WP Customer Reviews <= 3.6.6 - Authenticated (Subscriber+) Sensitive Information Exposure CVSS 3.1MEDIUM 4.3
Sources
- CVE-2021-24296 · CVE Program
- CVE-2021-24296 · NVD
- FIRST EPSS
- GHSA-r7g7-h9q3-437j · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences