MS-Reviews <= 1.5 – Subscriber+ Stored XSS | CVE 2023-0424 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape reviews, which could allow users any authenticated users, such as Subscribers to perform Stored Cross-Site Scripting attacks

Proof of Concept

As a subscriber, submit a review (a page/post with [ms_reviews] embed) with the following payload: <script>alert(/XSS/)</script>

The XSS will be triggered when anyone (including an admin) will view the page/post in the frontend

Affects Plugins

No known fix

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Rio Darmawan

Submitter

Rio Darmawan

Submitter twitter

Verified

Yes

WPVDB ID

b0f8713f-54b2-4ab2-a475-60a1692a50e9

Timeline

Publicly Published

2023-03-28 (about 2 years ago)

Added

2023-03-28 (about 2 years ago)

Last Updated

2023-03-28 (about 2 years ago)

Other

Published

Title

Published

2021-10-18

Title

LearnPress < 4.1.3.2 - Admin+ Stored Cross-Site Scripting

Published

2025-08-18

Title

Nexter Blocks < 4.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets

Published

2024-04-10

Title

Top Bar < 3.0.4 - Authenticated (Admin+) Stored Cross-Site Scripting

Published

2025-04-24

Title

Responsive Lightbox & Gallery < 2.5.1 - Contributor+ Stored XSS

Published

2025-07-23

Title

Mine CloudVod < 2.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via audio Parameter