CVE-2021-24894: Reviews Plus < 1.2.14 - Subscriber+ Reviews DoS

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-11-23 · updated 2026-06-17
Weakness: CWE-191

Description

The Reviews Plus WordPress plugin before 1.2.14 does not validate the submitted rating, allowing submission of long integer, causing a Denial of Service in the review section when an authenticated user submit such rating and the reviews are set to be displayed on the post/page

Affected products

impleCode Reviews Plus: before 1.2.14 — fixed in 1.2.14

How to fix

Upgrade to a fixed version: impleCode Reviews Plus 1.2.14. Check the vendor advisory for mitigations.

References

https://plugins.trac.wordpress.org/changeset/2618234
https://wpscan.com/vulnerability/79bb5acb-ea56-41a9-83a1-28a181ae41e2
https://plugins.trac.wordpress.org/changeset/2618234
https://wpscan.com/vulnerability/79bb5acb-ea56-41a9-83a1-28a181ae41e2

Get alerted when CVE-2021-24894 or the next vulnerability affects your stack