CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-4686 – WP Customer Reviews <= 3.6.6 - Authenticated (Subscriber+) Sensitive Information Exposure
https://notcve.org/view.php?id=CVE-2023-4686
The WP Customer Reviews plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.6.6 via the ajax_enabled_posts function. This can allow authenticated attackers to extract sensitive data such as post titles and slugs, including those of protected and trashed posts and pages in addition to other post types such as galleries. El complemento WP Customer Reviews para WordPress es vulnerable a la exposición de información confidencial en versiones hasta la 3.6.6 incluida a través de la función ajax_enabled_posts. Esto puede permitir a atacantes autenticados extraer datos confidenciales, como títulos de publicaciones y slugs, incluidos aquellos de publicaciones y páginas protegidas y eliminadas, además de otros tipos de publicaciones, como galerías. • https://plugins.trac.wordpress.org/browser/wp-customer-reviews/trunk/include/admin/wp-customer-reviews-3-admin.php?rev=2617376#L866 https://plugins.trac.wordpress.org/changeset/2965656/wp-customer-reviews/trunk?contextall=1&old=2882143&old_path=%2Fwp-customer-reviews%2Ftrunk https://www.wordfence.com/threat-intel/vulnerabilities/id/24b9984c-ec33-4492-815b-67a21ac4da0e?source=cve • CWE-862: Missing Authorization •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-4648 – WP Customer Reviews <= 3.6.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2023-4648
The WP Customer Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 3.6.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. El complemento WP Customer Reviews para WordPress es vulnerable a Cross-Site Scripting (XSS) Almacenado a través de la configuración de administrador en versiones hasta la 3.6.6 incluida debido a una sanitización de entrada y un escape de salida insuficientes. Esto hace posible que atacantes autenticados, con permisos de nivel de administrador y superiores, inyecten scripts web arbitrarios en páginas que se ejecutarán cada vez que un usuario acceda a una página inyectada. • https://plugins.trac.wordpress.org/changeset/2965658/wp-customer-reviews/trunk?contextall=1&old=2882143&old_path=%2Fwp-customer-reviews%2Ftrunk https://www.wordfence.com/threat-intel/vulnerabilities/id/f81950be-de32-4fa1-94fe-42667414fe2d?source=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-24296 – WP Customer Reviews < 3.5.6 - Authenticated Stored Cross-Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2021-24296
The WP Customer Reviews WordPress plugin before 3.5.6 did not sanitise some of its settings, allowing high privilege users such as administrators to set XSS payloads in them which will then be triggered in pages where reviews are enabled El plugin de WordPress WP Customer Reviews versiones anteriores a 3.5.6 no saneaba algunas de sus configuraciones, lo que permitía a usuarios muy privilegiados, como los administradores, configurar cargas útiles XSS en ellos, que luego se desencadenarán en las páginas donde las revisiones están habilitadas • https://wpscan.com/vulnerability/c450f54a-3372-49b2-8ad8-68d5cc0dd49e • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2021-24135 – WP Customer Reviews < 3.4.3 - Multiple Unauthenticated and Low Priv Authenticated Stored XSS
https://notcve.org/view.php?id=CVE-2021-24135
Unvalidated input and lack of output encoding in the WP Customer Reviews WordPress plugin, versions before 3.4.3, lead to multiple Stored Cross-Site Scripting vulnerabilities allowing remote attackers to inject arbitrary JavaScript code or HTML. Una entrada no comprobada y una falta de codificación de salida en el plugin de WordPress WP Customer Reviews, versiones anteriores a 3.4.3, conllevan a múltiples vulnerabilidades de tipo Cross-Site Scripting Almacenado que permiten a atacantes remotos inyectar código JavaScript o HTML arbitrario • https://wpscan.com/vulnerability/07e9e70b-97a6-42e3-b0de-8cb69dedcbd3 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2016-10901 – Customer Reviews < 3.0.9 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2016-10901
The wp-customer-reviews plugin before 3.0.9 for WordPress has XSS in the admin tools. El plugin wp-customer-reviews antes de 3.0.9 para WordPress tiene XSS en las herramientas de administración. The Customer Reviews Plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpcr3_debug_code' parameter in versions up to, and including, 3.0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. • https://wordpress.org/plugins/wp-customer-reviews/#developers • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •