CVE-2021-24296: WP Customer Reviews < 3.5.6 - Authenticated Stored Cross-Site Scripting (XSS)
The WP Customer Reviews WordPress plugin before 3.5.6 did not sanitise some of its settings, allowing high privilege users such as administrators to set XSS payloads in them which will then be triggered in pages where reviews are enabled
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-24296?
CVE-2021-24296 is a vulnerability in the WP Customer Reviews WordPress plugin before version 3.5.6 that allows high privilege users to set XSS payloads in certain settings.
How does CVE-2021-24296 impact WordPress websites?
CVE-2021-24296 allows high privilege users, such as administrators, to inject malicious XSS payloads into settings, which can be triggered on pages where the WP Customer Reviews plugin is enabled.
What is the severity of CVE-2021-24296?
CVE-2021-24296 has a severity rating of medium (4.8).
How can I fix CVE-2021-24296 in the WP Customer Reviews plugin?
To fix CVE-2021-24296, update the WP Customer Reviews plugin to version 3.5.6 or higher, which sanitizes the affected settings to prevent XSS attacks.
Where can I find more information about CVE-2021-24296?
You can find more information about CVE-2021-24296 at the following reference: [CVE-2021-24296 Reference](https://wpscan.com/vulnerability/c450f54a-3372-49b2-8ad8-68d5cc0dd49e)