{
 "id": "WPSEC-2026-0432",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0432/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0432/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0432/index.md",
 "title": "Rate My Post – Star Rating Plugin by FeedbackWP <= 4.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title in Top Rated Posts Widget",
 "description": "The Rate My Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles rendered by the top-rated posts shortcode, widget and block in all versions up to, and including, 4.5.2 due to missing output escaping of the post title, link and thumbnail values, including inside HTML attributes. This makes it possible for authenticated attackers with Contributor-level access and above to inject arbitrary web scripts into pages that execute whenever a user views the top-rated posts listing.",
 "plugin": {
  "slug": "rate-my-post",
  "name": "Rate My Post – Star Rating Plugin by FeedbackWP",
  "full_name": "Rate My Post – Star Rating Plugin by FeedbackWP",
  "wordpress_org": "https://wordpress.org/plugins/rate-my-post/",
  "advisories_url": "https://wpsec.com/vuln/plugin/rate-my-post/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/rate-my-post"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.5.3",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.5.3"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.5.3",
 "remediation": "Update to 4.5.3 or later.",
 "fix_released": "2026-10-03T17:42:10+00:00",
 "published": "2026-10-05T10:51:32+00:00",
 "updated": "2026-10-05T10:39:19.591787+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0432/",
  "https://plugins.svn.wordpress.org/rate-my-post/tags/4.5.3/",
  "https://wordpress.org/plugins/rate-my-post/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/rate-my-post",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-05"
 }
}