CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VideoWhisper Rate Star Review – AJAX Reviews for Content, with Star Ratings allows Reflected XSS.This issue affects Rate Star Review – AJAX Reviews for Content, with Star Ratings: from n/a through 1.5.1.
Explanation of Vulnerability in Simple Terms
The Rate Star Review plugin for WordPress contains a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into review content. An attacker can craft a malicious review that executes JavaScript in the browsers of site visitors who view it. The vulnerability affects versions up to 1.5.1 and requires a visitor to view the compromised review for the attack to succeed.
What an attacker can do
Inject JavaScript code that runs in visitors' browsers when they view reviews on your site.
Potential impact on your site
Attackers can steal visitor session cookies, redirect users to phishing sites, or deface review content without your knowledge.
Conditions required to exploit
No authentication required. A site visitor must view a page containing the malicious review.
Key dates
External resources
Related vulnerabilities
