Absolute Reviews Vulnerabilities

[en] The Absolute Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Name' field of a custom post criteria in all versions up to, and including, 1.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level ac...

Affected:

up to 1.1.4

Fixed in:

1.1.4

Disclosed:

Sep 27, 2024

CVE-2024-8965 on NVD →

The Absolute Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Name' field of a custom post criteria in all versions up to, and including, 1.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...

CVSS:

6.4

Affected:

up to 1.1.3

Fixed in:

1.1.4

Disclosed:

Sep 26, 2024

CVE-2024-8965 on NVD →

[en] The Absolute Reviews plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.8. This is due to missing or incorrect nonce validation on the metabox_review_save() function. This makes it possible for unauthenticated attackers to save meta tags via a forged request gran...

Affected:

up to 1.0.9

Fixed in:

1.0.9

Disclosed:

Jul 12, 2023

CVE-2021-4426 on NVD →

Affected:

up to 1.0.9

Fixed in:

1.0.9

Disclosed:

Jun 7, 2023

CVE-2021-4342 on NVD →

The Absolute Reviews plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.8. This is due to missing or incorrect nonce validation on the metabox_review_save() function. This makes it possible for unauthenticated attackers to save meta tags via a forged request granted t...

CVSS:

4.3

Affected:

up to 1.0.8

Fixed in:

1.0.9

Disclosed:

Jun 21, 2021

CVE-2021-4426 on NVD →

Cross-Site Request Forgery (CSRF) vulnerability discovered by Jerome Bruandet (NinTechNet) in WordPress Absolute Reviews plugin (versions <= 1.0.8).

Affected:

up to 1.0.9

Fixed in:

1.0.9

Disclosed:

Jun 21, 2021

Multiple plugins are affected by CSRF bypass as they do not properly check for the nonce due to a logic flaw. This could allow attackers to make logged in users do unwanted actions

Affected:

up to 1.0.9

Fixed in:

1.0.9

Over 70 plugins and themes were vulnerable to Cross-Site Request Forgery due to improperly implemented nonce protection that could be bypassed.

Affected:

up to 1.0.9

Fixed in:

1.0.9