TI-2021-07252 Aliases CVE-2021-24973 GHSA-4p7m-87rg-hcph

Site Reviews < 5.17.3 - Unauthenticated Stored Cross-Site Scripting

LOW 30CWE-79Published 2022-01-03 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

The Site Reviews WordPress plugin before 5.17.3 does not sanitise and escape the site-reviews parameter of the glsr_action AJAX action (available to unauthenticated and any authenticated users), allowing them to perform Cross-Site Scripting attacks against logged in admins viewing the Tool dashboard of the plugin

Why it matters now

EPSS 0.01335 71st percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed Site Reviews (Unknown): 5.17.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Unknown	Site Reviews	5.17.3 to before 5.17.3	5.17.3	Patch available	CNA

Site Reviews VendorUnknown Affected 5.17.3 to before 5.17.3 Fixed in 5.17.3 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:geminilabs:site_reviews::::::wordpress::*	before 5.17.3	Vulnerable	Gemini Labs

cpe:2.3:a:geminilabs:site_reviews:*:*:*:*:*:wordpress:*:* Versions before 5.17.3 Vulnerable ·Gemini Labs

Remediation

Fix · CNA Site Reviews (Unknown) Fixed in 5.17.3

Timeline

2026-10-02 Threatist record created from CVE-2021-24973
2026-10-03 Alias added: GHSA-4p7m-87rg-hcph

References

Exploit 1

https://wpscan.com/vulnerability/0118f245-0e6f-44c1-9bdb-5b3a5d2403d6

Patch 1

https://plugins.trac.wordpress.org/changeset/2629821

TI-2024-02856 Site Reviews < 7.0.0 - IP Spoofing CVSS 3.1CRITICAL 9.1
TI-2025-01056 Site Reviews < 7.2.5 - Unauthenticated Stored XSS CVSS 3.1HIGH 8.8
TI-2023-01439 Site Reviews < 6.7.1 - Admin+ Stored XSS CVSS 3.1MEDIUM 4.8
TI-2022-23147 WordPress Site Reviews Plugin <= 6.2.0 is vulnerable to CSV Injection CVSS 3.1CRITICAL 9.8
TI-2018-00560 Cross-site scripting in Gemini Labs Site Reviews CVSS 3.0MEDIUM 6.1
TI-2023-12339 WordPress Site Reviews Plugin <= 6.5.1 is vulnerable to Cross Site Scripting (XSS) CVSS 3.1MEDIUM 6.5

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences