What is the CVSS score of CVE-2026-6864?

CVE-2026-6864 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

CBX 5 Star Rating CVE-2026-6864

EUVD-2026-31409 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-22 Wordfence

GHSA-jf98-h9cw-4365

WordPress XSS

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 22, 2026 - 05:18 vuln.today

DescriptionCVE.org

The CBX 5 Star Rating & Review plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.0.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrator into performing an action such as clicking on a link.

AnalysisAI

Reflected Cross-Site Scripting in the CBX 5 Star Rating & Review WordPress plugin (versions up to and including 1.0.7) allows unauthenticated remote attackers to inject arbitrary JavaScript via the unsanitized 'page' parameter rendered in administrative log templates. Successful exploitation requires social engineering an authenticated administrator into clicking a crafted URL, limiting automated mass exploitation while remaining a realistic threat in targeted phishing campaigns against WordPress site owners. No public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting) describes this root cause: the 'page' URL parameter is echoed into HTML output without sanitization or output escaping. The specific injection points are confirmed in two admin-facing template files at line 41 each: admin-rating-review-rating-avg-logs.php and admin-rating-review-review-logs.php, both present in the 1.0.7 plugin release on the WordPress plugin repository (trac.wordpress.org). The vendor is identified via CPE as 'manchumahara' (cpe:2.3:a:manchumahara:cbx_5_star_rating_&_review). The CVSS Scope is Changed (S:C), meaning injected scripts execute in a security context beyond the vulnerable plugin itself - concretely, inside the authenticated admin browser session - enabling session token theft or unauthorized admin actions beyond plugin boundaries.

RemediationAI

Update the CBX 5 Star Rating & Review plugin to version 1.0.8 or later; the WordPress plugin repository confirms that 1.0.8 contains corrected versions of both admin-rating-review-rating-avg-logs.php and admin-rating-review-review-logs.php with proper input sanitization and output escaping applied. Full details are documented in the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/9ee11e19-21a6-45df-a118-f6dec3b55bc1. If immediate patching is not possible, restrict WordPress admin dashboard access to known trusted IP addresses at the server or WAF level (e.g., via .htaccess IP allowlisting or a cloud WAF rule), which eliminates the delivery vector for crafted admin links; note this may disrupt legitimate remote administration workflows. Additionally, security-aware email filtering and admin security training reduce phishing success rates against the required UI:R step.