PT-2025-11664 · Unknown · Site Reviews

Dmitry Ignatyev · Published 2025-03-19 · Updated 2025-05-09 · CVE-2025-1232

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Site Reviews WordPress plugin versions prior to 7.2.5

Description The issue concerns the Site Reviews WordPress plugin, which does not properly sanitise and escape some of its review fields. This could allow unauthenticated users to perform Stored XSS attacks.

Recommendations For versions prior to 7.2.5, update to version 7.2.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the review fields until a patch is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-1232

Affected Products

Site Reviews

References · 10

• 🔥 https://wpscan.com/vulnerability/c4ea8357-ddd7-48ac-80c9-15b924715b14 · Exploit
• https://osv.dev/vulnerability/CVE-2025-1232 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-1232 · Security Note
• https://t.me/cvetracker/19423 · Telegram Post
• https://t.me/cvenotify/121546 · Telegram Post
• https://t.me/latest_high_impact_cve/2000 · Telegram Post
• https://twitter.com/cracbot/status/1904126125045125525 · Twitter Post
• https://t.me/cvenotify/115298 · Telegram Post
• https://t.me/cvedetector/20623 · Telegram Post
• https://twitter.com/CVEnew/status/1902243757648695493 · Twitter Post