Vulnerabilities

TI-2024-01721 CVE-2024-1849 · GHSA-9qx9-7q55-qhq4

WP Customer Reviews < 3.7.1 - Malicious Redirect via HTTP-EQUIV Injection

MEDIUM 58

The WP Customer Reviews WordPress plugin before 3.7.1 does not validate a parameter allowing contributor and above users to redirect a page to a malicious URL

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00495 Published 2024-04-15 Fixed in 3.7.1

TI-2023-04318 CVE-2023-4686 · GHSA-q9mg-8x46-h8mx

WP Customer Reviews <= 3.6.6 - Authenticated (Subscriber+) Sensitive Information Exposure

LOW 21

The WP Customer Reviews plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.6.6 via the ajax_enabled_posts function.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00648 Published 2023-11-22 No fix listed CWE-862

TI-2023-04284 CVE-2023-4648 · GHSA-4grg-q38c-r772

WP Customer Reviews <= 3.6.6 - Authenticated (Administrator+) Stored Cross-Site Scripting

LOW 22

The WP Customer Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 3.6.6 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00356 Published 2023-10-20 No fix listed CWE-79

TI-2021-06588 CVE-2021-24296 · GHSA-r7g7-h9q3-437j

WP Customer Reviews < 3.5.6 - Authenticated Stored Cross-Site Scripting (XSS)

LOW 23

The WP Customer Reviews WordPress plugin before 3.5.6 did not sanitise some of its settings, allowing high privilege users such as administrators to set XSS payloads in them which will then be triggered in pages where re…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00617 Published 2021-05-24 Fixed in 3.5.6 CWE-79

TI-2021-06427 CVE-2021-24135 · GHSA-x4q4-7cpx-gg5v

WP Customer Reviews < 3.4.3 - Multiple Unauthenticated and Low Priv Authenticated Stored XSS

LOW 29

Unvalidated input and lack of output encoding in the WP Customer Reviews WordPress plugin, versions before 3.4.3, lead to multiple Stored Cross-Site Scripting vulnerabilities allowing remote attackers to inject arbitrary…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01085 Published 2021-03-18 Fixed in 3.4.3 CWE-79

TI-2016-08940 CVE-2016-10902 · GHSA-5jc7-hxvg-4m8x

The wp-customer-reviews plugin before 3.0.9 for WordPress has CSRF in the admin tools.

LOW 39

The wp-customer-reviews plugin before 3.0.9 for WordPress has CSRF in the admin tools.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.0068 Published 2019-08-21 No fix listed CWE-352

TI-2016-08939 CVE-2016-10901 · GHSA-7w62-3gcr-qh6w

The wp-customer-reviews plugin before 3.0.9 for WordPress has XSS in the admin tools.

LOW 29

The wp-customer-reviews plugin before 3.0.9 for WordPress has XSS in the admin tools.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00913 Published 2019-08-21 No fix listed CWE-79

Vulnerabilities

Filters

WP Customer Reviews < 3.7.1 - Malicious Redirect via HTTP-EQUIV Injection

WP Customer Reviews <= 3.6.6 - Authenticated (Subscriber+) Sensitive Information Exposure

WP Customer Reviews <= 3.6.6 - Authenticated (Administrator+) Stored Cross-Site Scripting

WP Customer Reviews < 3.5.6 - Authenticated Stored Cross-Site Scripting (XSS)

WP Customer Reviews < 3.4.3 - Multiple Unauthenticated and Low Priv Authenticated Stored XSS

The wp-customer-reviews plugin before 3.0.9 for WordPress has CSRF in the admin tools.

The wp-customer-reviews plugin before 3.0.9 for WordPress has XSS in the admin tools.