Geminilabs
Geminilabs Site Reviews: vulnerabilidades y CVE
Geminilabs Site Reviews tiene 18 vulnerabilidades publicadas, 5 de ellas en los últimos 12 meses. 2 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE18
Últimos 12 meses5
Críticas2
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-103340 | Media (5.3) | 0.18% | — | 1 oct 2026 | Missing Authorization vulnerability in Gemini Labs Site Reviews site-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Site Reviews: from n/a through 8.3.2. |
| CVE-2026-94078 | Alta (7.1) | 0.20% | — | 30 sept 2026 | Unauthenticated Cross Site Scripting (XSS) in Site Reviews <= 8.3.1 versions. |
| CVE-2026-82925 | Alta (8.1) | 0.45% | — | 10 sept 2026 | The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized, and derives the key protecting that data by padding out the site's WordPress nonce key, which makes the key publicly… |
| CVE-2026-73382 | Alta (7.1) | 0.25% | — | 18 ago 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gemini Labs Site Reviews site-reviews allows Stored XSS.This issue affects Site Reviews: from n/a through 8.2.0. |
| CVE-2026-57318 | Media (6.5) | 0.37% | — | 26 jun 2026 | Subscriber Sensitive Data Exposure in Site Reviews <= 8.0.11 versions. |
| CVE-2025-1232 | Alta (8.8) | 1.9% | — | 19 mar 2025 | The Site Reviews WordPress plugin before 7.2.5 does not properly sanitise and escape some of its Review fields, which could allow unauthenticated users to perform Stored XSS attacks |
| CVE-2023-49832 | Media (5.3) | 0.50% | — | 9 dic 2024 | Missing Authorization vulnerability in Gemini Labs Site Reviews site-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Site Reviews: from n/a through <= 6.10.2. |
| CVE-2023-27625 | Media (4.3) | 0.40% | — | 9 dic 2024 | Missing Authorization vulnerability in Paul Ryley Site Reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Site Reviews: from n/a through 6.5.0. |
| CVE-2024-3050 | Crítica (9.1) | 0.56% | — | 29 may 2024 | The Site Reviews WordPress plugin before 7.0.0 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to bypass IP-based blocking |
| CVE-2024-29095 | Media (5.9) | 0.32% | — | 19 mar 2024 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gemini Labs Site Reviews site-reviews.This issue affects Site Reviews: from n/a through <= 6.11.6. |
| CVE-2024-2293 | Media (6.4) | 0.55% | — | 13 mar 2024 | The Site Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user display name in all versions up to, and including, 6.11.4 due to insufficient input sanitization and output escaping. This… |
| CVE-2022-46801 | Crítica (9.8) | 0.70% | — | 7 nov 2023 | Improper Neutralization of Formula Elements in a CSV File vulnerability in Paul Ryley Site Reviews.This issue affects Site Reviews: from n/a through 6.2.0. |
| CVE-2023-27629 | Media (5.4) | 0.41% | — | 22 jun 2023 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Paul Ryley Site Reviews plugin <= 6.5.1 versions. |
| CVE-2023-27612 | Media (5.4) | 0.40% | — | 22 jun 2023 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Paul Ryley Site Reviews plugin <= 6.5.1 versions. |
| CVE-2023-1525 | Media (4.8) | 0.50% | — | 2 may 2023 | The Site Reviews WordPress plugin before 6.7.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the… |
| CVE-2021-24973 | Media (6.1) | 1.3% | — | 3 ene 2022 | The Site Reviews WordPress plugin before 5.17.3 does not sanitise and escape the site-reviews parameter of the glsr_action AJAX action (available to unauthenticated and any authenticated users), allowing them to perform… |
| CVE-2021-24603 | Media (5.4) | 0.62% | — | 6 sept 2021 | The Site Reviews WordPress plugin before 5.13.1 does not sanitise some of its Review Details when adding a review as an admin, which could allow them to perform Cross-Site Scripting attacks when the unfiltered_html is… |
| CVE-2018-0603 | Media (6.1) | 1.3% | — | 26 jun 2018 | Cross-site scripting vulnerability in Site Reviews versions prior to 2.15.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.