CVE-2021-24296

PoC —

CVSS 3.1

4.8 medium

EPSS

<1%p48

Published

May 24, 2021 (May 24, 2021)

Modified

Jun 17, 2026

Description

The WP Customer Reviews WordPress plugin before 3.5.6 did not sanitise some of its settings, allowing high privilege users such as administrators to set XSS payloads in them which will then be triggered in pages where reviews are enabled

Vendors: gowebsolutions
Products: wp customer reviews
Ecosystems: WordPress
Weakness: CWE-79
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.6%)

In the news0 stories

No ingested article mentions this CVE yet.