The vulnerability in the Simple Rating plugin allows a malicious actor to trick a victim into submitting a forged request that stores malicious JavaScript code on the site. Once the payload is stored, any user visiting the affected page will execute the script in their browser, potentially compromising user sessions, stealing credentials, or defacing content. The weakness is a classic CSRF that leads to stored XSS, represented by CWE-352.

The flaw appears in all releases of Igor Yavych’s Simple Rating plugin up to and including version 1.4. Sites running the plugin in those versions are at risk; the issue does not affect later releases beyond 1.4.

With a CVSS score of 7.1 the vulnerability is considered high severity. The EPSS score of less than 1% suggests that recent exploitation is unlikely, and the issue is not listed in CISA’s KEV catalog. Nonetheless, the combination of CSRF and stored XSS offers an attack path where an unsuspecting user can be made to load the site with a forged request, after which the injected script runs with the victim’s privileges. The risk is heightened on sites where the rating feature is openly accessible to unauthenticated visitors.