CVE-2021-24753: Starfish Rich Review

High severity, CVSS 7.2. EPSS: 1.5% chance of exploitation in the next 30 days.

The Rich Reviews by Starfish WordPress plugin before 1.9.6 does not properly validate the orderby GET parameter of the pending reviews page before using it in a SQL statement, leading to an authenticated SQL injection issue

Affected products

• Starfish Rich Review: before 1.9.6 (fixed in 1.9.6)

Published 2021-12-27. Last modified 2026-06-17.