CVE-2021-24973

CVE-2021-24973: Site Reviews < 5.17.3 - Unauthenticated Stored Cross-Site Scripting

Vendor Unknown

Product Site Reviews

Weakness CWE-79 · XSS

Published January 3, 2022

Last update August 3, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The Site Reviews WordPress plugin before 5.17.3 does not sanitise and escape the site-reviews parameter of the glsr_action AJAX action (available to unauthenticated and any authenticated users), allowing them to perform Cross-Site Scripting attacks against logged in admins viewing the Tool dashboard of the plugin

Key dates

02Disclosure timeline

January 3, 2022 CVE published

August 3, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2021-24973 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2022-45817 WordPress GC Testimonials Plugin <= 1.3.2 is vulnerable to Cross Site Scripting (XSS) CVE-2026-6559 Wavlink WL-WN579A3 login.cgi sub_401F80 cross site scripting CVE-2021-24608 Formidable Form Builder < 5.0.07 - Admin+ Stored Cross-Site Scripting CVE-2025-10553 Stored Cross-site Scripting (XSS) vulnerability affecting Factory Resource Management in DELMIA Factory Resource Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x CVE-2023-34225