Site Reviews Vulnerability – Authenticated Stored Cross-Site Scripting via Display Name – CVE-2024-2293 | WordPress Plugin Vulnerability Report 

Plugin Name: Site Reviews

Key Information:

  • Software Type: Plugin
  • Software Slug: site-reviews
  • Software Status: Active
  • Software Author: geminilabs
  • Software Downloads: 2,210,571
  • Active Installs: 60,000
  • Last Updated: March 13, 2024
  • Patched Versions: 6.11.7
  • Affected Versions: <= 6.11.4

Vulnerability Details:

  • Name: Site Reviews <= 6.11.4
  • Title: Authenticated(Subscriber+) Stored Cross-Site Scripting via Display Name
  • Type: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
  • CVE: CVE-2024-2293
  • CVSS Score: 6.4
  • Publicly Published: March 11, 2024
  • Researcher: stealthcopter
  • Description: The Site Reviews plugin for WordPress has been found vulnerable to Stored Cross-Site Scripting (XSS) attacks through insufficiently sanitized and escaped user display names in versions up to and including 6.11.4. Authenticated users with subscriber-level permissions or higher can exploit this vulnerability to inject malicious scripts that are executed when other users view the affected pages.


The Site Reviews plugin, widely utilized for integrating review functionality into WordPress sites, has been compromised in versions up to 6.11.4, allowing for Authenticated Stored Cross-Site Scripting attacks via the user display name. This vulnerability, identified as CVE-2024-2293, poses a significant threat to site security and user privacy but has been effectively patched in version 6.11.7.

Detailed Overview:

Security researcher stealthcopter uncovered this vulnerability, emphasizing the critical need for robust data sanitization and validation within plugins. The exploitation of this vulnerability could lead to various security issues, including unauthorized data access, website defacement, and the potential spread of malware. The update to version 6.11.7 addresses this issue by implementing enhanced sanitization and escaping mechanisms.

Advice for Users:

  • Immediate Action: Update to version 6.11.7 of the Site Reviews plugin immediately to protect your WordPress site from potential exploits.
  • Check for Signs of Vulnerability: Regularly monitor your website for any suspicious activities or content alterations, which may indicate the exploitation of this vulnerability.
  • Alternate Plugins: While the patched version resolves this specific vulnerability, exploring alternative review plugins might offer additional security features or functionalities better suited to your needs.
  • Stay Updated: Ensuring that all WordPress themes, plugins, and core installations are updated to their latest versions is crucial for maintaining site security and functionality.


The resolution of CVE-2024-2293 within the Site Reviews plugin underscores the ongoing importance of maintaining security vigilance within the WordPress ecosystem. For WordPress site administrators, especially those managing small businesses or personal blogs, the commitment to regular software updates and an awareness of security best practices is essential for protecting digital assets. Proactive security measures are key to ensuring a secure and trustworthy online environment for all users.


  • Wordfence Vulnerability Report on Site Reviews
  • Additional Information on Site Reviews Vulnerabilities

In an era where digital presence is indispensable, ensuring the security of your WordPress website is paramount. A recent discovery of a vulnerability in the "Site Reviews" plugin, widely utilized for integrating user reviews into WordPress sites, highlights the constant vigilance required to safeguard digital assets. This vulnerability, identified as CVE-2024-2293, presents a significant risk to site integrity and user privacy, underscoring the necessity of keeping your website's components up to date.

Vulnerability Insights:

CVE-2024-2293 exposes a Stored Cross-Site Scripting (XSS) flaw within the Site Reviews plugin, specifically through the user's display name. Versions up to and including 6.11.4 are affected due to inadequate input sanitization and output escaping. This flaw allows authenticated users, with subscriber-level permissions or higher, to execute arbitrary web scripts, compromising the security and privacy of site users and administrators alike.

Implications and Risks:

The vulnerability poses a multifaceted threat, enabling potential attackers to undertake a range of malicious activities from unauthorized data access and modification to the distribution of malware. The inherent risk of Stored XSS attacks lies in their persistence; the injected malicious scripts can remain unnoticed within the website, activating whenever the compromised content is accessed.

Mitigation and User Guidance:

To address this vulnerability, the plugin developers have released a patched version, 6.11.7. Site owners using Site Reviews are urged to update to this latest version immediately to secure their sites. Additionally, it's advisable to:

  • Regularly audit site activities and review user permissions to detect any unusual or unauthorized changes promptly.
  • Consider alternative plugins if they better align with your site's security and functional requirements.

Historical Context:

This is not the first time vulnerabilities have been discovered in the Site Reviews plugin, with 9 previous instances recorded since May 2018. Each incident serves as a learning opportunity and a reminder of the dynamic nature of cybersecurity threats.


The resolution of CVE-2024-2293 within the Site Reviews plugin serves as a critical reminder for all WordPress site owners, especially small business operators with limited IT support, about the importance of regular software updates. Staying informed about potential vulnerabilities and adopting proactive security measures are indispensable strategies for protecting digital assets in an ever-evolving cyber threat landscape. Vigilance and prompt action in updating software components are key to maintaining a secure and trustworthy online environment.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

Site Reviews Vulnerability – Authenticated Stored Cross-Site Scripting via Display Name – CVE-2024-2293 | WordPress Plugin Vulnerability Report FAQs

Leave a Comment