CVE-2021-24296

CVE-2021-24296: WP Customer Reviews < 3.5.6 - Authenticated Stored Cross-Site Scripting (XSS)

Vendor Go Web Solutions

Product WP Customer Reviews

Weakness CWE-79 · XSS

Published May 24, 2021

Last update August 3, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The WP Customer Reviews WordPress plugin before 3.5.6 did not sanitise some of its settings, allowing high privilege users such as administrators to set XSS payloads in them which will then be triggered in pages where reviews are enabled

Key dates

02Disclosure timeline

May 24, 2021 CVE published

August 3, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2021-24296 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2026-35390 Content-Security-Policy was set to Report-Only mode, failing to block XSS attacks CVE-2024-2068 SourceCodester Computer Inventory System update-computer.php cross site scripting CVE-2025-4991 Stored Cross-site Scripting (XSS) vulnerability affecting 3D Markup in Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x CVE-2024-8661 Concrete CMS version 9.0.0 to 9.3.3 and below 8.5.19 are vulnerable to Stored XSS in the "Next&Previous Nav" block CVE-2024-0320 Cross-Site Scripting in FireEye Malware Analysis (AX)