CVE-2025-1232

HIGHNuclei

Site Reviews < 7.2.5 - Unauthenticated Stored XSS

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2025-1232 has a selected CVSS score of 8.8 (high); EIP currently links 1 Nuclei template.

Description

The Site Reviews WordPress plugin before 7.2.5 does not properly sanitise and escape some of its Review fields, which could allow unauthenticated users to perform Stored XSS attacks

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 19, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Site Reviews

Default status: unaffected

CVE ListBefore 7.2.5affected

Nuclei templates

1
ProjectDiscoveryHIGHSite Reviews < 7.2.5 - Unauthenticated Stored XSSCVSS 8.8

Site Reviews WordPress plugin before 7.2.5 contains a stored cross-site scripting caused by improper sanitization and escaping of review fields, letting unauthenticated users execute malicious scripts, exploit requires no authentication.

Impact

Unauthenticated users can execute malicious scripts in the context of site visitors, potentially leading to session hijacking or defacement.

Remediation

Update to version 7.2.5 or later.

WeaknessesCWE-79
Authors0x_Akoko
Template tagscvecve2025wordpresswpwp-pluginsite-reviewsxssstored
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:geminilabs:site-reviews:*:*:*:*:*:wordpress:*:*
Shodan: http.component:"WordPress"
FOFA: body="site-reviews" || body="glsr-form"
https://wpscan.com/vulnerability/c4ea8357-ddd7-48ac-80c9-15b924715b14/ https://nvd.nist.gov/vuln/detail/CVE-2025-1232 https://research.cleantalk.org/cve-2025-1232/

Source: ProjectDiscovery

References

2