Stored Cross-Site Scripting in Site Reviews Plugin for WordPress

CVE-2024-2293

Summary

The Site Reviews plugin for WordPress suffers from a vulnerability that allows authenticated users, specifically those with subscriber access and above, to exploit insufficient input sanitization and output escaping in the user display name field. This oversight enables attackers to inject arbitrary web scripts into the pages viewed by other users, effectively leading to the execution of malicious scripts when these pages are accessed. All versions of the plugin up to and including 6.11.4 are affected, raising serious concerns over user data integrity and security.

References