JetReviews vulnerabilities

The Crocoblock JetReviews (jet-reviews) plugin contains a Stored Cross-site Scripting (XSS) vulnerability caused by improper neutralization of input during web page generation. The issue affects versions from n/a through 3.1.2.

The JetReviews plugin version 3.0.0.1 and earlier contains a Cross Site Scripting (XSS) vulnerability exploitable by subscribers. It allows injection of malicious scripts into the page by a user with the subscriber role.

The JetReviews WordPress plugin (versions up to 3.0.1) contains a vulnerability that exposes sensitive system information to unauthorized parties. An attacker can exploit this flaw to retrieve embedded confidential data.