geminilabs vulnerabilities

Products

• site reviews 10

Latest geminilabs CVEs

Newest publication first

1. CVE-2025-1232 Site Reviews < 7.2.5 - Unauthenticated Stored XSS

   Published 2025-03-19

   High·CVSS 8.8 EPSS 1.9%

   The Site Reviews WordPress plugin before 7.2.5 does not properly sanitise and escape some of its Review fields, which could allow unauthenticated users to perform Stored XSS attacks

2. CVE-2024-3050 Site Reviews < 7.0.0 - IP Spoofing

   Published 2024-05-29

   Critical·CVSS 9.1 EPSS 0.57%

   The Site Reviews WordPress plugin before 7.0.0 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to bypass IP-based blocking

3. CVE-2024-2293 Site Reviews <= 6.11.4 - Authenticated(Subscriber+) Stored Cross-Site Scripting via display name

   Published 2024-03-13

   Medium·CVSS 6.4 EPSS 0.55%

   The Site Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user display name in all versions up to, and including, 6.11.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscribe...

4. CVE-2022-46801 WordPress Site Reviews Plugin <= 6.2.0 is vulnerable to CSV Injection

   Published 2023-11-07

   Critical·CVSS 9.8 EPSS 0.89%

   Improper Neutralization of Formula Elements in a CSV File vulnerability in Paul Ryley Site Reviews.This issue affects Site Reviews: from n/a through 6.2.0.

5. CVE-2023-27612 WordPress Site Reviews Plugin <= 6.5.1 is vulnerable to Cross Site Scripting (XSS)

   Published 2023-06-22

   Medium·CVSS 5.4 EPSS 0.40%

   Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Paul Ryley Site Reviews plugin <= 6.5.1 versions.

6. CVE-2023-27629 WordPress Site Reviews Plugin <= 6.5.1 is vulnerable to Cross Site Scripting (XSS)

   Published 2023-06-22

   Medium·CVSS 5.4 EPSS 0.41%

   Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Paul Ryley Site Reviews plugin <= 6.5.1 versions.

7. CVE-2023-1525 Site Reviews < 6.7.1 - Admin+ Stored XSS

   Published 2023-05-02

   Medium·CVSS 4.8 EPSS 0.50%

   The Site Reviews WordPress plugin before 6.7.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite s...

8. CVE-2021-24973 Site Reviews < 5.17.3 - Unauthenticated Stored Cross-Site Scripting

   Published 2022-01-03

   Medium·CVSS 6.1 EPSS 1.3%

   The Site Reviews WordPress plugin before 5.17.3 does not sanitise and escape the site-reviews parameter of the glsr_action AJAX action (available to unauthenticated and any authenticated users), allowing them to perform Cross-Site Scripting attacks against logged in admins viewin...

9. CVE-2021-24603 Site Reviews < 5.13.1 - Authenticated Stored XSS

   Published 2021-09-06

   Medium·CVSS 5.4 EPSS 0.62%

   The Site Reviews WordPress plugin before 5.13.1 does not sanitise some of its Review Details when adding a review as an admin, which could allow them to perform Cross-Site Scripting attacks when the unfiltered_html is disallowed

10. CVE-2018-0603 Site Reviews <= 2.15.2 - Cross-Site Scripting

    Published 2018-06-26

    Medium·CVSS 6.1 EPSS 1.3%

    Cross-site scripting vulnerability in Site Reviews versions prior to 2.15.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.