# Starfish Review Generation & Marketing for WordPress <= 3.1.31 - Unauthenticated HTML Injection via Feedback Form in Notification Emails

- **ID:** WPSEC-2026-2014
- **Plugin:** Starfish Review Generation & Marketing for WordPress (`starfish-reviews`), https://wordpress.org/plugins/starfish-reviews/
- **Affected versions:** all versions before 3.1.32
- **Fixed in:** 3.1.32 (Update to 3.1.32 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-80
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-30)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/starfish-reviews
- **Fix released:** 2026-10-29
- **Published:** 2026-10-30
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2014/

## Description

The Starfish Review Generation & Marketing for WordPress plugin for WordPress is vulnerable to HTML Injection via the public funnel feedback form in all versions up to, and including, 3.1.31, due to the notification email passing the whole message through html_entity_decode() after visitor values (feedback message, reviewer name and phone, tracking ID) were placed into the template. Entity-encoded markup therefore came out as live HTML. This makes it possible for unauthenticated attackers to inject arbitrary HTML, such as phishing links, into the feedback notification emails sent to site administrators and funnel recipients.

## References

- https://wpsec.com/vuln/WPSEC-2026-2014/
- https://plugins.svn.wordpress.org/starfish-reviews/tags/3.1.32/
- https://wordpress.org/plugins/starfish-reviews/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2014/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.