VULNERABILITY INTELLIGENCE

CVE-2021-24296

CVSS score4.8 MEDIUM
EPSS probability0.62%
CISA KEVNot currently listed
Published2021-05-24
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Description

The WP Customer Reviews WordPress plugin before 3.5.6 did not sanitise some of its settings, allowing high privilege users such as administrators to set XSS payloads in them which will then be triggered in pages where reviews are enabled

Weakness classification

  • contact@wpscan.com: CWE-79

Primary references