Vulnerabilities / Rate My Post – Star Rating Plugin by FeedbackWP / WPSEC-2026-0432
Rate My Post – Star Rating Plugin by FeedbackWP <= 4.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title in Top Rated Posts Widget
Medium 6.4
CWE-79Fixed in 4.5.3
- ID
- WPSEC-2026-0432
- Plugin
- Rate My Post – Star Rating Plugin by FeedbackWP (rate-my-post)
- Affected
- all versions before 4.5.3
- Remediation
- Update to 4.5.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-05
- Attack surface
- Rate My Post – Star Rating Plugin by FeedbackWP on WPSec AttackSurface
- Fix released
- Published
Description
The Rate My Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles rendered by the top-rated posts shortcode, widget and block in all versions up to, and including, 4.5.2 due to missing output escaping of the post title, link and thumbnail values, including inside HTML attributes. This makes it possible for authenticated attackers with Contributor-level access and above to inject arbitrary web scripts into pages that execute whenever a user views the top-rated posts listing.
References
- https://wpsec.com/vuln/WPSEC-2026-0432/
- https://plugins.svn.wordpress.org/rate-my-post/tags/4.5.3/
- https://wordpress.org/plugins/rate-my-post/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS