The Starred Review WordPress plugin contains an input validation flaw that allows a reflected cross‑site scripting (XSS) attack. The flaw arises because the plugin outputs the PHP_SELF variable without proper sanitization or escaping. An attacker can craft a URL that includes malicious JavaScript; when an unsuspecting user clicks the link and the plugin renders the page, the script executes in the visitor’s browser. This can lead to cookie theft, session hijacking, defacement or unauthorized actions performed with the victim’s privileges.

WordPress installations using the Starred Review plugin from the callumalden vendor, with any version up to and including 1.4.2. Users of earlier releases are unaffected; updates beyond 1.4.2 contain the mitigating changes.

The vulnerability scores a CVSS of 6.1, indicating medium severity, and has an EPSS of less than 1%, implying a low likelihood of exploitation in the wild. It is not listed in the CISA KEV catalog. The attack is unauthenticated and depends on social engineering—tricking a user to visit a crafted URL. Given the low EPSS, the risk is moderate but still significant for sites that expose the plugin’s output to untrusted users.