Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

9 records

Vendor: Gemini Labs Component: Site Reviews Clear all filters
TI-2025-01056 CVE-2025-1232 · GHSA-6qw8-39x3-j5rj

Site Reviews < 7.2.5 - Unauthenticated Stored XSS

Priority HIGH 73

The Site Reviews WordPress plugin before 7.2.5 does not properly sanitise and escape some of its Review fields, which could allow unauthenticated users to perform Stored XSS attacks

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01931 Published 2025-03-19 Fixed in 7.2.5 CWE-79
TI-2024-02856 CVE-2024-3050

Site Reviews < 7.0.0 - IP Spoofing

Priority HIGH 80

The Site Reviews WordPress plugin before 7.0.0 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00565 Published 2024-05-29 Fixed in 7.0.0
TI-2022-23147 CVE-2022-46801 · GHSA-rx9f-2j6q-9pff

WordPress Site Reviews Plugin <= 6.2.0 is vulnerable to CSV Injection

Priority MEDIUM 50

Improper Neutralization of Formula Elements in a CSV File vulnerability in Paul Ryley Site Reviews.This issue affects Site Reviews: from n/a through 6.2.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00876 Published 2023-11-07 No fix listed CWE-1236
TI-2023-01439 CVE-2023-1525 · GHSA-c62j-xm9j-qw97

Site Reviews < 6.7.1 - Admin+ Stored XSS

Priority MEDIUM 55

The Site Reviews WordPress plugin before 6.7.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilter…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00501 Published 2023-05-02 Fixed in 6.7.1 CWE-79
TI-2021-07252 CVE-2021-24973 · GHSA-4p7m-87rg-hcph

Site Reviews < 5.17.3 - Unauthenticated Stored Cross-Site Scripting

Priority LOW 30

The Site Reviews WordPress plugin before 5.17.3 does not sanitise and escape the site-reviews parameter of the glsr_action AJAX action (available to unauthenticated and any authenticated users), allowing them to perform…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01335 Published 2022-01-03 Fixed in 5.17.3 CWE-79
TI-2021-06886 CVE-2021-24603 · GHSA-j3qx-4gvc-v53m

Site Reviews < 5.13.1 - Authenticated Stored XSS

Priority LOW 25

The Site Reviews WordPress plugin before 5.13.1 does not sanitise some of its Review Details when adding a review as an admin, which could allow them to perform Cross-Site Scripting attacks when the unfiltered_html is di…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00624 Published 2021-09-06 Fixed in 5.13.1 CWE-79
TI-2018-00560 CVE-2018-0603 · GHSA-46rm-6xmg-3mgq

Cross-site scripting in Gemini Labs Site Reviews

Priority LOW 30

Cross-site scripting vulnerability in Site Reviews versions prior to 2.15.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01288 Published 2018-06-26 No fix listed CWE-79