# Rate My Post – Star Rating Plugin by FeedbackWP <= 4.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title in Top Rated Posts Widget

- **ID:** WPSEC-2026-0432
- **Plugin:** Rate My Post – Star Rating Plugin by FeedbackWP (`rate-my-post`), https://wordpress.org/plugins/rate-my-post/
- **Affected versions:** all versions before 4.5.3
- **Fixed in:** 4.5.3 (Update to 4.5.3 or later.)
- **Severity:** Medium 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-05)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/rate-my-post
- **Fix released:** 2026-10-03
- **Published:** 2026-10-05
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0432/

## Description

The Rate My Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles rendered by the top-rated posts shortcode, widget and block in all versions up to, and including, 4.5.2 due to missing output escaping of the post title, link and thumbnail values, including inside HTML attributes. This makes it possible for authenticated attackers with Contributor-level access and above to inject arbitrary web scripts into pages that execute whenever a user views the top-rated posts listing.

## References

- https://wpsec.com/vuln/WPSEC-2026-0432/
- https://plugins.svn.wordpress.org/rate-my-post/tags/4.5.3/
- https://wordpress.org/plugins/rate-my-post/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0432/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.