CVE-2025-1232

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-1232

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

T

he Site Reviews WordPress plugin before 7.2.5 does not properly sanitise and escape some of its Review fields, which could allow unauthenticated users to perform Stored XSS attacks

References
Link Resource
https://wpscan.com/vulnerability/c4ea8357-ddd7-48ac-80c9-15b924715b14/ Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:geminilabs:site_reviews:*:*:*:*:*:wordpress:*:*
History

09 May 2025, 12:00

Type Values Removed Values Added
CPE cpe:2.3:a:geminilabs:site_reviews:*:*:*:*:*:wordpress:*:*
References () https://wpscan.com/vulnerability/c4ea8357-ddd7-48ac-80c9-15b924715b14/ - () https://wpscan.com/vulnerability/c4ea8357-ddd7-48ac-80c9-15b924715b14/ - Exploit, Third Party Advisory
CWE CWE-79
First Time Geminilabs site Reviews
Geminilabs

19 Mar 2025, 15:15

Type Values Removed Values Added
Summary
  • (es) El complemento Site Reviews de WordPress anterior a la versión 7.2.5 no depura ni escapa correctamente algunos de sus campos de revisión, lo que podría permitir que usuarios no autenticados realicen ataques XSS almacenado.
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.8

19 Mar 2025, 06:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-19 06:15

Updated : 2025-05-09 12:00

NVD link : CVE-2025-1232

Mitre link : CVE-2025-1232

CVE.ORG link : CVE-2025-1232

JSON object : View

Products Affected

geminilabs

CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')