Vulnerabilities and security researches forrate-star-review rate-star-review

Jun 10, 2024

CVE, Research URL: CVE-2023-52213
Home page URL: Security reports for Rate Star Review Vote – AJAX Reviews, Votes, Star Ratings
Application: Rate Star Review Vote – AJAX Reviews, Votes, Star Ratings
Date: Jan 09, 2024
Research Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VideoWhisper Rate Star Review – AJAX Reviews for Content, with Star Ratings allows Reflected XSS.This issue affects Rate Star Review – AJAX Reviews for Content, with Star Ratings: from n/a through 1.5.1.
Affected versions: max 1.5.2.
Status: vulnerable

Jan 19, 2025

CVE, Research URL: CVE-2024-13392
Home page URL: Security reports for Rate Star Review Vote – AJAX Reviews, Votes, Star Ratings
Application: Rate Star Review Vote – AJAX Reviews, Votes, Star Ratings
Date: Jan 18, 2025
Research Description: The Rate Star Review Vote – AJAX Reviews, Votes, Star Ratings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhisper_reviews' shortcode in all versions up to, and including, 1.6.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions: max 1.6.4.
Status: vulnerable

May 14, 2026

CVE, Research URL: CVE-2026-4301
Home page URL: Security reports for Rate Star Review Vote – AJAX Reviews, Votes, Star Ratings
Application: Rate Star Review Vote – AJAX Reviews, Votes, Star Ratings
Date: May 12, 2026
Research Description: The Rate Star Review Vote - AJAX Reviews, Votes, Star Ratings plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.6.4. The vwrsr_review() AJAX handler lacks both capability checks and nonce verification. The only access control is an is_user_logged_in() check. When the 'form' parameter is set to 'update', the function takes an arbitrary post ID from the user-supplied 'rating_id' GET parameter, sets it as the post ID in the update array, and passes it directly to wp_update_post(). This overwrites the target post's title, content, author (changed to the attacker's user ID), post_type (changed to the plugin's custom post type, default 'review'), and status. Additionally, update_post_meta() is called on the arbitrary post ID at lines 758-763, modifying its metadata. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the title, content, author, post type, and metadata of arbitrary posts and pages on the site via the 'rating_id' parameter, effectively allowing full post content takeover.
Affected versions: max 1.6.4.
Status: vulnerable