Stored Cross-Site Scripting in Site Reviews Plugin for WordPress

CVE-2024-2293

What is CVE-2024-2293?

The Site Reviews plugin for WordPress suffers from a vulnerability that allows authenticated users, specifically those with subscriber access and above, to exploit insufficient input sanitization and output escaping in the user display name field. This oversight enables attackers to inject arbitrary web scripts into the pages viewed by other users, effectively leading to the execution of malicious scripts when these pages are accessed. All versions of the plugin up to and including 6.11.4 are affected, raising serious concerns over user data integrity and security.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References