CVE-2024-3050: critical vulnerability in Site Reviews
Site Reviews < 7.0.0 - IP Spoofing
Published · Updated
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.1epss 0.6%
exploitation probability
0.6%top 55% of all CVEs
observed exploitation
nono source reports it
The Site Reviews WordPress plugin before 7.0.0 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to bypass IP-based blocking
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected products
Unknown · Site ReviewsRelated CVEs — Site Reviews
In the same product, most dangerous first.
CVE-2025-1232HIGHSite Reviews < 7.2.5 - Unauthenticated Stored XSSEPSS 1.9%CVE-2021-24973—Site Reviews < 5.17.3 - Unauthenticated Stored Cross-Site ScriptingEPSS 1.3%CVE-2021-24603—Site Reviews < 5.13.1 - Authenticated Stored XSSEPSS 0.6%CVE-2023-1525MEDIUMSite Reviews < 6.7.1 - Admin+ Stored XSSEPSS 0.5%CVE-2026-82925HIGHSite Reviews 7.2.2 - 8.2.2 - Unauthenticated PHP Object Injection via Form SignatureEPSS 0.5%