{
 "id": "WPSEC-2026-2014",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2014/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2014/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2014/index.md",
 "title": "Starfish Review Generation & Marketing for WordPress <= 3.1.31 - Unauthenticated HTML Injection via Feedback Form in Notification Emails",
 "description": "The Starfish Review Generation & Marketing for WordPress plugin for WordPress is vulnerable to HTML Injection via the public funnel feedback form in all versions up to, and including, 3.1.31, due to the notification email passing the whole message through html_entity_decode() after visitor values (feedback message, reviewer name and phone, tracking ID) were placed into the template. Entity-encoded markup therefore came out as live HTML. This makes it possible for unauthenticated attackers to inject arbitrary HTML, such as phishing links, into the feedback notification emails sent to site administrators and funnel recipients.",
 "plugin": {
  "slug": "starfish-reviews",
  "name": "Starfish Review Generation & Marketing for WordPress",
  "full_name": "Starfish Review Generation & Marketing for WordPress",
  "wordpress_org": "https://wordpress.org/plugins/starfish-reviews/",
  "advisories_url": "https://wpsec.com/vuln/plugin/starfish-reviews/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/starfish-reviews"
 },
 "type": "CONTENT INJECTION",
 "cwe": [
  "CWE-80"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.1.32",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.1.32"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.1.32",
 "remediation": "Update to 3.1.32 or later.",
 "fix_released": "2026-10-29T08:49:12+00:00",
 "published": "2026-10-30T09:42:55+00:00",
 "updated": "2026-10-29T17:44:40.450682+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2014/",
  "https://plugins.svn.wordpress.org/starfish-reviews/tags/3.1.32/",
  "https://wordpress.org/plugins/starfish-reviews/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/starfish-reviews",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-30"
 }
}