Stored Cross-Site Scripting Vulnerability in GD Rating System by WordPress

CVE-2026-93430

What is CVE-2026-93430?

The GD Rating System plugin for WordPress exhibits a Stored Cross-Site Scripting vulnerability due to inadequate input sanitization and output escaping in the 'title' and 'url' Render Args of the gdrts_live_handler AJAX functionality. This flaw allows unauthenticated attackers to inject malicious web scripts into web pages. When users access these compromised pages, the injected scripts execute, potentially leading to unauthorized access or data manipulation. Although an AJAX action nonce is utilized for item operations, its visibility in the block on every page circumvents any intended security, leaving all users exposed to XSS threats.

References