Aaron Queen

@theswan I don’t believe this was intended to be a review for the WP Customer Reviews plugin. It sounds like a review of wordpress.org itself? If so, are you willing to remove or edit your review to reflect this?

Thanks!

@petermjames 3.5.3 has just been released which allows more attributes on both A and IMG tags, this should cover your clever use case.

@gilou24 Your web server or cache configuration is loading an old version of this required file (from a previous version of the plugin)

https://www.un-jardin-bio.com/wp-content/plugins/wp-customer-reviews/js/wp-customer-reviews.js?ver=3.5.1

In the actual 3.5.1 version, the text “ajaxAct2” will appear if you search the contents, but it does not appear in the version running on your site. The version your site is serving appears to actually be prior to 3.5.0 so it’s definitely something with cache on your site (a plugin?).

The expected file: https://plugins.trac.wordpress.org/browser/wp-customer-reviews/trunk/js/wp-customer-reviews.js where you can find “ajaxAct2” if you search the contents.

I have no insight into what caching plugins or web server / hosting caching might be in place, but they appear to be ignoring query strings on JavaScript / CSS assets, which is going to always cause you headaches.

If you have a way of purging/clearing cache on your site via some plugin you are running, this should resolve the issue, but like I said, any time a plugin or WordPress itself updates, you’re going to run into issues if your caching system continues to ignore query strings ( the ?ver=# portion of the above URL )

@kopite05 @ashincabo We’ll have a fix for this released shortly.

@cactus182 @dbrong – Please update to version 3.5.0. It should prevent these spammy exploit attempts.

@essaysnark – We published an update rapidly after being made aware of the issue. Users are notified of available plugin updates in the WordPress backend. Pinning an announcment on the forum or creating a blog post wouldn’t get in front of users, as it’s highly unlikely that users who don’t regularly login to their WP backend are going to find a random blog post or be active on this support forum.

We were made aware of it privately directly by WordPress.org admins, and addressed it within hours of being notified.

I’m not aware of any reports of XSS attempts prior to this thread. Whoever is attempting this is probably hitting the WP admin-ajax URL directly, likely not even visiting the page itself.

We can detect common XSS attempts and prevent the garbled (now-escaped) mess from cluttering up the backend reviews list. If that would help, let me know and I’ll incorporate some guards in the plugin.

I think you may be reviewing the wrong plugin. There is an overall rating field that is always shown. There also is no Pro version released to date, just the free version.

You can’t use POSTID=”ALL” and also have the form display. You need to use the post or page id which is associated with your reviews. The reason is because the reviews are linked to a post, and can’t be linked to “all” posts if that makes sense.