Description

Unauthenticated Cross Site Scripting (XSS) in Site Reviews <= 8.2.0 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-18T15:17:06.280Z",
  "pubdate": "2026-08-18T15:17:06.280Z",
  "executiveSummary": "An unauthenticated Cross-Site Scripting (XSS) vulnerability exists in the Site Reviews plugin for versions 8.2.0 and below. This security flaw allows remote, unauthenticated threat actors to inject malicious scripts, typically JavaScript, into vulnerable input vectors rendered within the context of a victim's browser. The primary impact of this vulnerability includes unauthorized script execution, potential session hijacking, credential theft, and manipulation of the DOM on affected WordPress sites utilizing the plugin. The risk implications are severe for site administrators and visitors alike, as exploitation requires no prior authentication or specialized privileges, lowering the barrier to entry for malicious actors. Attackers can leverage this flaw by crafting weaponized links or payloads that, when interacted with or viewed by unsuspecting users or administrators, execute arbitrary code within the trusted session boundary. Exploitation depends on the lack of proper input sanitization and output encoding within the affected component, allowing arbitrary web content injection.",
  "technicalDetails": "The vulnerability stems from insufficient sanitization of user-supplied input and inadequate output encoding within the Site Reviews plugin <= 8.2.0. The vulnerable component fails to properly validate and escape data submitted by unauthenticated users before rendering it back to the browser via the application response. Because the application blindly trusts the input data stream, malicious payloads containing HTML or JavaScript tags are processed and reflected directly into the Document Object Model (DOM). The attack vector is network-based and accessible remotely without requiring authentication or specific user privileges. The step-by-step attack flow proceeds as follows: First, the attacker identifies an input parameter or submission form handled by the Site Reviews plugin that lacks appropriate input sanitization. Second, the attacker crafts a malicious payload containing executable JavaScript encapsulated within HTML tags. Third, the attacker submits this payload via the vulnerable parameter or induces a victim to load a crafted URL containing the malicious payload. Fourth, the server processes the input and stores or reflects it back in the HTTP response without performing contextual output encoding. Fifth, when the victim's browser parses the response, the injected JavaScript executes within the security context of the victim's active session. Post-exploitation impact encompasses unauthorized actions performed on behalf of the user, exposure of sensitive session tokens, redirection to malicious infrastructure, and potential compromise of administrative accounts if an administrator views the crafted content."
}