CVE-2021-24894

MEDIUM

Reviews Plus < 1.2.14 - Authenticated Denial of Service via Rating Submission

Title source: llm

Description

The Reviews Plus WordPress plugin before 1.2.14 does not validate the submitted rating, allowing submission of long integer, causing a Denial of Service in the review section when an authenticated user submit such rating and the reviews are set to be displayed on the post/page

References (2)

Core 2

Core References

Exploit, Third Party Advisory x_refsource_misc

https://wpscan.com/vulnerability/79bb5acb-ea56-41a9-83a1-28a181ae41e2

Patch, Third Party Advisory x_refsource_confirm

https://plugins.trac.wordpress.org/changeset/2618234

Scores

CVSS v3 6.5

EPSS 0.0143

EPSS Percentile 69.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Details

CWE

CWE-191 CWE-20

Status published

Products (1)

implecode/reviews_plus < 1.2.14

Published Nov 23, 2021

Tracked Since Feb 18, 2026