Filtered by vendor Geminilabs Subscriptions
Filtered by product Site Reviews Subscriptions
Total 7 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2022-46801 1 Geminilabs 1 Site Reviews 2023-11-14 9.8 Critical
Improper Neutralization of Formula Elements in a CSV File vulnerability in Paul Ryley Site Reviews.This issue affects Site Reviews: from n/a through 6.2.0.
CVE-2023-1525 1 Geminilabs 1 Site Reviews 2023-11-07 4.8 Medium
The Site Reviews WordPress plugin before 6.7.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVE-2023-27612 1 Geminilabs 1 Site Reviews 2023-06-28 5.4 Medium
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Paul Ryley Site Reviews plugin <= 6.5.1 versions.
CVE-2023-27629 1 Geminilabs 1 Site Reviews 2023-06-28 5.4 Medium
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Paul Ryley Site Reviews plugin <= 6.5.1 versions.
CVE-2021-24973 1 Geminilabs 1 Site Reviews 2022-01-08 6.1 Medium
The Site Reviews WordPress plugin before 5.17.3 does not sanitise and escape the site-reviews parameter of the glsr_action AJAX action (available to unauthenticated and any authenticated users), allowing them to perform Cross-Site Scripting attacks against logged in admins viewing the Tool dashboard of the plugin
CVE-2021-24603 1 Geminilabs 1 Site Reviews 2021-09-09 5.4 Medium
The Site Reviews WordPress plugin before 5.13.1 does not sanitise some of its Review Details when adding a review as an admin, which could allow them to perform Cross-Site Scripting attacks when the unfiltered_html is disallowed
CVE-2018-0603 1 Geminilabs 1 Site Reviews 2018-08-17 N/A
Cross-site scripting vulnerability in Site Reviews versions prior to 2.15.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.