CVE-2021-24135: WP Customer Reviews < 3.4.3 - Multiple Unauthenticated and Low Priv Authenticated Stored XSS

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-03-18 · updated 2026-06-17
Weakness: CWE-79

Description

Unvalidated input and lack of output encoding in the WP Customer Reviews WordPress plugin, versions before 3.4.3, lead to multiple Stored Cross-Site Scripting vulnerabilities allowing remote attackers to inject arbitrary JavaScript code or HTML.

Affected products

bompus WP Customer Reviews: before 3.4.3 — fixed in 3.4.3

How to fix

Upgrade to a fixed version: bompus WP Customer Reviews 3.4.3. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/07e9e70b-97a6-42e3-b0de-8cb69dedcbd3
https://wpscan.com/vulnerability/07e9e70b-97a6-42e3-b0de-8cb69dedcbd3

Get alerted when CVE-2021-24135 or the next vulnerability affects your stack