CVE-2023-1525

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The Site Reviews WordPress plugin before 6.7.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	Site Reviews	< 6.7.1

References

https://wpscan.com/vulnerability/4ae6bf90-b100-4bb5-bdd7-8acdbd950596Exploit, Third Party Advisory
https://wpscan.com/vulnerability/4ae6bf90-b100-4bb5-bdd7-8acdbd950596Exploit, Third Party Advisory

Timeline

Published: May 2, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-15264.6Certain DesignJet and PageWide XL TAA compliant models may have risk of potential information disclosure if the hard disk drive is physicall CVE-2023-15275.4Cross-site Scripting (XSS) - Generic in GitHub repository tsolucio/corebos prior to 8.0.CVE-2023-15288.8Use after free in Passwords in Google Chrome prior to 111.0.5563.110 allowed a remote attacker who had compromised the renderer process to p CVE-2023-15299.8Out of bounds memory access in WebHID in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corrupt CVE-2023-15308.8Use after free in PDF in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corruption via a crafte CVE-2023-15318.8Use after free in ANGLE in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corruption via a craf CVE-2023-15328.8Out of bounds read in GPU Video in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corruption vi CVE-2023-15338.8Use after free in WebProtect in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corruption via a CVE-2023-15348.8Out of bounds read in ANGLE in Google Chrome prior to 111.0.5563.110 allowed a remote attacker who had compromised the renderer process to p CVE-2023-15355.4Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.7.CVE-2023-15365.4Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.7.CVE-2023-15379.8Authentication Bypass by Capture-replay in GitHub repository answerdev/answer prior to 1.0.6.