EUVD-2026-40251
GHSA-c3mc-8j5j-vh28
Severity by source
AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Administrator credentials required (PR:H) and specific post meta context adds complexity (AC:H); scope changes as XSS executes in victim browsers (S:C) with limited confidentiality and integrity impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Editorial Rating - Product Review & Rating System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'Link URL' Field in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The WordPress unfiltered_html capability exemption does not apply here because the payload is stored in post meta (_wpas_er_options via update_post_meta) rather than in post_content or post_excerpt, meaning the restriction affects all administrators regardless of their unfiltered_html status.
AnalysisAI
Stored Cross-Site Scripting in the Editorial Rating - Product Review & Rating System WordPress plugin (versions ≤ 4.0.5) enables authenticated administrators to inject persistent JavaScript payloads via the 'Link URL' field, which execute in any site visitor's browser upon loading an affected review page. The attack exploits a WordPress-specific sanitization bypass: because the payload is stored in post meta (_wpas_er_options via update_post_meta) rather than post_content or post_excerpt, WordPress's unfiltered_html capability exemption does not apply, meaning the restriction affects all administrators regardless of their unfiltered_html status. No public exploit has been identified at time of analysis and no active exploitation is confirmed; real-world risk is substantially constrained by the PR:H (administrator) prerequisite.
Technical ContextAI
The affected product is the 'Editorial Rating - Product Review & Rating System' plugin by wpqode (CPE: cpe:2.3:a:wpqode:editorial_rating_-_product_review_&_rating_system:*:*:*:*:*:*:*:*) for the WordPress CMS platform. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a failure to sanitize input stored in the 'Link URL' field and a failure to escape output when that value is rendered. Wordfence source references confirm vulnerable code paths in wpas-theme-1.php at lines 57 and 87, class-average-score-public_display.php at line 90, and metabox-options.php at line 446 - present in both the 4.0.3 and 4.0.5 plugin tags. The critical technical nuance is the storage mechanism: WordPress applies built-in sanitization to post_content and post_excerpt via the wp_kses pipeline, but update_post_meta() bypasses this pipeline entirely. An administrator's unfiltered_html capability - which governs whether raw HTML is preserved in post_content - is irrelevant here because the vector is post meta, meaning even multisite or hardened configurations offer no additional protection.
RemediationAI
No vendor-released patched version beyond 4.0.5 is confirmed in the available data - patch status should be verified directly against the WordPress plugin repository (https://wordpress.org/plugins/editorial-rating/) and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/26c63d73-6ce2-4b3a-b0d9-29f7d9b368d5. If a version newer than 4.0.5 is available, upgrade immediately. As an interim compensating control, restrict WordPress administrator access to the minimum number of fully trusted individuals and enforce multi-factor authentication on all admin accounts - this directly addresses the PR:H prerequisite and eliminates the most realistic attack paths (credential compromise, rogue admin). If the Editorial Rating plugin is not actively required, deactivate and remove it until a patched release is confirmed; deactivation removes the vulnerable post meta input surface entirely with no functional trade-off for sites not using the feature. Web Application Firewall rules targeting XSS payloads in wp-admin POST requests can provide supplementary detection but should not substitute for patching due to bypass risk.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today