WPDeveloper reviewx vulnerabilities

Latest WPDeveloper reviewx CVEs

Newest publication first

1. CVE-2023-40670 WordPress ReviewX plugin <= 1.6.17 - Broken Access Control vulnerability

   Published 2024-12-13

   Medium·CVSS 4.3 EPSS 0.48%

   Missing Authorization vulnerability in ReviewX Team ReviewX allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ReviewX: from n/a through 1.6.17.

2. CVE-2024-43323 WordPress ReviewX plugin <= 1.6.28 - Broken Access Control vulnerability

   Published 2024-11-01

   Critical·CVSS 9.8 EPSS 0.48%

   Missing Authorization vulnerability in ReviewX ReviewX allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ReviewX: from n/a through 1.6.28.

3. CVE-2024-3609 ReviewX – Multi-criteria Rating & Reviews for WooCommerce <= 1.6.27 - Missing Authorization

   Published 2024-05-16

   Medium·CVSS 4.3 EPSS 0.37%

   The ReviewX – Multi-criteria Rating & Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized deletion of data due to a missing capability check on the reviewx_remove_guest_image function in all versions up to, and including, 1.6.27. This makes it possible for...

4. CVE-2024-33921 WordPress ReviewX plugin <= 1.6.21 - Broken Access Control vulnerability

   Published 2024-05-03

   High·CVSS 8.8 EPSS 0.40%

   Broken Access Control vulnerability in ReviewX.This issue affects ReviewX: from n/a through 1.6.21.

5. CVE-2024-29812 WordPress ReviewX plugin <= 1.6.22 - Cross Site Scripting (XSS) vulnerability

   Published 2024-03-27

   Medium·CVSS 5.4 EPSS 0.36%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ReviewX allows Stored XSS.This issue affects ReviewX: from n/a through 1.6.22.

6. CVE-2022-46809 WordPress ReviewX Plugin <= 1.6.7 is vulnerable to CSV Injection

   Published 2023-11-07

   Critical·CVSS 9.8 EPSS 0.84%

   Improper Neutralization of Formula Elements in a CSV File vulnerability in WPDeveloper ReviewX – Multi-criteria Rating & Reviews for WooCommerce.This issue affects ReviewX – Multi-criteria Rating & Reviews for WooCommerce: from n/a through 1.6.7.

7. CVE-2023-2833 ReviewX <= 1.6.13 - Arbitrary Usermeta Update to Authenticated (Subscriber+) Privilege Escalation

   Published 2023-06-06

   High·CVSS 8.8 EPSS 17.5%

   The ReviewX plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.6.13 due to insufficient restriction on the 'rx_set_screen_options' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscrib...

8. CVE-2023-26325 ReviewX – Multi-criteria Rating & Reviews for WooCommerce <= 1.6.8 - Authenticated (Subscriber+) SQL Injection

   Published 2023-02-23

   High·CVSS 8.8 EPSS 0.87%

   The 'rx_export_review' action in the ReviewX WordPress Plugin, is affected by an authenticated SQL injection vulnerability in the 'filterValue' and 'selectedColumns' parameters.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.