WordPress Plugin Vulnerabilities

Site Reviews <= 2.15.2 - Cross-Site Scripting (XSS)

Description

The Site Reviews WordPress plugin was affected by a Cross-Site Scripting (XSS) security vulnerability.

Affects Plugins

Plugin icon
site-reviews
Fixed in 2.15.3

References

CVE
CVE-2018-0603
URL
https://jvn.jp/en/jp/JVN60978548/index.html
URL
https://plugins.trac.wordpress.org/changeset/1877081/site-reviews

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.1 (medium)

Miscellaneous

Submitter
Ryan
Submitter twitter
ethicalhack3r
Verified
No
WPVDB ID
65406f72-2b42-406f-8c68-7d641ca3f851

Timeline

Publicly Published
2018-05-28 (about 7 years ago)
Added
2018-06-28 (about 7 years ago)
Last Updated
2020-09-22 (about 5 years ago)

Other

Published
Title
Published
2024-12-20
Title
Shortcodes and extra features for Phlox theme < 2.17.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via aux_contact_box and aux_gmaps Shortcodes
Published
2024-08-29
Title
Fluida < 1.8.8.1 - Contributor+ Stored XSS
Published
2021-12-27
Title
Tutor LMS < 1.9.12 - Reflected Cross-Site Scripting
Published
2025-10-09
Title
Survey Maker < 5.1.8.9 - Unauthenticated Stored Cross-Site Scripting
Published
2023-02-13
Title
Announce from the Dashboard < 1.5.2 - Admin+ Stored XSS