Stored Cross-Site Scripting Vulnerability in Editorial Rating Plugin for WordPress

CVE-2026-12560

What is CVE-2026-12560?

The Editorial Rating – Product Review & Rating System plugin for WordPress introduces a serious Stored Cross-Site Scripting vulnerability due to inadequate input sanitization and output escaping in the 'Link URL' field. This flaw allows authenticated attackers with administrator privileges to inject malicious web scripts that execute when any user accesses the compromised page. Notably, the standard WordPress restriction associated with the unfiltered_html capability does not apply, as the attack payload is stored in post meta rather than the content areas typically governed by this restriction. This poses a significant risk to site integrity and user security.

References