GD Rating System EUVD-2026-91922

Exploitable only against sites running the GD Rating System plugin (versions up to and including 3.7.1) with at least one rating item rendered on a publicly reachable page - that rendering is what exposes the per-item nonce in the gdrts-rating-data JSON block and makes the gdrts_live_handler AJAX action usable by an anonymous visitor. No authentication, privileges, or attacker-side user interaction are required to inject via the 'title'/'url' Render Args. The practical limiting factor is that the stored payload only executes when a victim subsequently browses the affected page, so impact scales with page traffic; impact is confined to client-side script execution (C:L/I:L, no availability or direct server impact), and sites that do not expose rating items publicly materially reduce exposure.

This is a genuine, actionable priority but not a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C) confirmed by Wordfence rates it 7.2 High: fully remote, low-complexity, and unauthenticated, which is the worst-case access profile. The unauthenticated status is credible here because the description explains the per-item nonce - the only apparent gatekeeper - is publicly emitted in the <script class="gdrts-rating-data"> JSON block on every page rendering a rating item, so it is not a real authentication barrier (consistent with the PR:N in the vector). Offsetting this, impact is limited to C:L/I:L/A:N (stored XSS, no direct server compromise), and the scope change (S:C) reflects script execution crossing into victims' browser contexts rather than privilege escalation on the host. No EPSS score, no CISA KEV listing, and no public exploit code are present in the provided data, so there is no evidence of active exploitation or mass scanning - exploitation status is 'no public exploit identified at time of analysis.' One caveat the raw vector hides: although UI:N is scored for the attacker's injection step, the payload only fires when a user later visits the poisoned page, so real-world impact depends on victim traffic. Net: treat as a standard high-severity WordPress plugin XSS to patch promptly, weighted down by a modest deployment footprint and the absence of any exploitation signal.

An unauthenticated attacker loads any public page that displays a GD Rating System rating item and scrapes the per-item nonce from the inline gdrts-rating-data JSON block. They then send a crafted gdrts_live_handler AJAX request supplying a malicious 'title' or 'url' Render Arg, storing a JavaScript payload that is served back without proper sanitization or output escaping. When any subsequent visitor - potentially including a logged-in administrator - views the affected page, the script executes in their browser, enabling session/cookie theft or admin-context actions. No public exploit code is referenced in the provided data.