Starfish Review Generation & Marketing for WordPress <= 3.1.31 - Unauthenticated HTML Injection via Feedback Form in Notification Emails
- ID
- WPSEC-2026-2014
- Plugin
- Starfish Review Generation & Marketing for WordPress (starfish-reviews)
- Affected
- all versions before 3.1.32
- Remediation
- Update to 3.1.32 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-80
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-30
- Attack surface
- Starfish Review Generation & Marketing for WordPress on WPSec AttackSurface
- Fix released
- Published
Description
The Starfish Review Generation & Marketing for WordPress plugin for WordPress is vulnerable to HTML Injection via the public funnel feedback form in all versions up to, and including, 3.1.31, due to the notification email passing the whole message through html_entity_decode() after visitor values (feedback message, reviewer name and phone, tracking ID) were placed into the template. Entity-encoded markup therefore came out as live HTML. This makes it possible for unauthenticated attackers to inject arbitrary HTML, such as phishing links, into the feedback notification emails sent to site administrators and funnel recipients.
References
- https://wpsec.com/vuln/WPSEC-2026-2014/
- https://plugins.svn.wordpress.org/starfish-reviews/tags/3.1.32/
- https://wordpress.org/plugins/starfish-reviews/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS