TI-2021-07174 Aliases CVE-2021-24894 GHSA-cg9v-q8q5-prwx

Reviews Plus < 1.2.14 - Subscriber+ Reviews DoS

LOW 32CWE-191Published 2021-11-23 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-191 and the CVSS impact.

Summary

The Reviews Plus WordPress plugin before 1.2.14 does not validate the submitted rating, allowing submission of long integer, causing a Denial of Service in the review section when an authenticated user submit such rating and the reviews are set to be displayed on the post/page

Why it matters now

EPSS 0.0148 74th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed Reviews Plus (Unknown): 1.2.14

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Unknown	Reviews Plus	1.2.14 to before 1.2.14	1.2.14	Patch available	CNA

Reviews Plus VendorUnknown Affected 1.2.14 to before 1.2.14 Fixed in 1.2.14 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:implecode:reviews_plus::::::wordpress::*	before 1.2.14	Vulnerable	impleCode

cpe:2.3:a:implecode:reviews_plus:*:*:*:*:*:wordpress:*:* Versions before 1.2.14 Vulnerable ·impleCode

Remediation

Fix · CNA Reviews Plus (Unknown) Fixed in 1.2.14

Timeline

2026-10-02 Threatist record created from CVE-2021-24894
2026-10-03 Alias added: GHSA-cg9v-q8q5-prwx

References

Exploit 1

https://wpscan.com/vulnerability/79bb5acb-ea56-41a9-83a1-28a181ae41e2

Patch 1

https://plugins.trac.wordpress.org/changeset/2618234

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences