CVE-2025-1232 - Vulnerability Details - OpenCVE

The Site Reviews WordPress plugin before 7.2.5 does not properly sanitise and escape some of its Review fields, which could allow unauthenticated users to perform Stored XSS attacks

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00365.

Exploitation poc

Automatable no

Technical Impact total

Vendors	Products
Geminilabs	Site Reviews

Configuration 1 [-]

cpe:2.3:a:geminilabs:site_reviews:*:*:*:*:*:wordpress:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2025-6715	The Site Reviews WordPress plugin before 7.2.5 does not properly sanitise and escape some of its Review fields, which could allow unauthenticated users to perform Stored XSS attacks

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://wpscan.com/vulnerability/c4ea8357-ddd7-48ac-80c9-15b924715b14/

History

Fri, 09 May 2025 12:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Geminilabs Geminilabs site Reviews
Weaknesses		CWE-79
CPEs		cpe:2.3:a:geminilabs:site_reviews::::::wordpress::*
Vendors & Products		Geminilabs Geminilabs site Reviews

Wed, 19 Mar 2025 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Wed, 19 Mar 2025 06:15:00 +0000

Type	Values Removed	Values Added
Description		The Site Reviews WordPress plugin before 7.2.5 does not properly sanitise and escape some of its Review fields, which could allow unauthenticated users to perform Stored XSS attacks
Title		Site Reviews < 7.2.5 - Unauthenticated Stored XSS
References		https://wpscan.com/vulnerability/c4ea8357-ddd7-48ac-80c9-15b924715b14/

MITRE

Status: PUBLISHED

Assigner: WPScan

Published: 2025-03-19T06:00:02.199Z

Updated: 2025-03-19T14:36:35.550Z

Reserved: 2025-02-11T14:10:57.503Z

Link: CVE-2025-1232

Vulnrichment

Updated: 2025-03-19T14:36:04.652Z

NVD

Status : Analyzed

Published: 2025-03-19T06:15:15.940

Modified: 2025-05-09T12:00:30.697

Link: CVE-2025-1232

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-1232", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "state": "PUBLISHED", "assignerShortName": "WPScan", "dateReserved": "2025-02-11T14:10:57.503Z", "datePublished": "2025-03-19T06:00:02.199Z", "dateUpdated": "2025-03-19T14:36:35.550Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2025-03-19T06:00:02.199Z"}, "title": "Site Reviews < 7.2.5 - Unauthenticated Stored XSS", "problemTypes": [{"descriptions": [{"description": "CWE-79 Cross-Site Scripting (XSS)", "lang": "en", "type": "CWE"}]}], "affected": [{"vendor": "Unknown", "product": "Site Reviews", "versions": [{"status": "affected", "versionType": "semver", "version": "0", "lessThan": "7.2.5"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Site Reviews WordPress plugin before 7.2.5 does not properly sanitise and escape some of its Review fields, which could allow unauthenticated users to perform Stored XSS attacks"}], "references": [{"url": "https://wpscan.com/vulnerability/c4ea8357-ddd7-48ac-80c9-15b924715b14/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "credits": [{"lang": "en", "value": "Dmitrii Ignatyev", "type": "finder"}, {"lang": "en", "value": "WPScan", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "WPScan CVE Generator"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-03-19T14:36:28.015786Z", "id": "CVE-2025-1232", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-19T14:36:35.550Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-1232", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-03-19T14:36:28.015786Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-19T14:36:04.652Z"}}], "cna": {"title": "Site Reviews < 7.2.5 - Unauthenticated Stored XSS", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Dmitrii Ignatyev"}, {"lang": "en", "type": "coordinator", "value": "WPScan"}], "affected": [{"vendor": "Unknown", "product": "Site Reviews", "versions": [{"status": "affected", "version": "0", "lessThan": "7.2.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://wpscan.com/vulnerability/c4ea8357-ddd7-48ac-80c9-15b924715b14/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "x_generator": {"engine": "WPScan CVE Generator"}, "descriptions": [{"lang": "en", "value": "The Site Reviews WordPress plugin before 7.2.5 does not properly sanitise and escape some of its Review fields, which could allow unauthenticated users to perform Stored XSS attacks"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-79 Cross-Site Scripting (XSS)"}]}], "providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2025-03-19T06:00:02.199Z"}}}, "cveMetadata": {"cveId": "CVE-2025-1232", "state": "PUBLISHED", "dateUpdated": "2025-03-19T14:36:35.550Z", "dateReserved": "2025-02-11T14:10:57.503Z", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "datePublished": "2025-03-19T06:00:02.199Z", "assignerShortName": "WPScan"}, "dataVersion": "5.1"}