The vulnerability resides in the Link URL field of the Editorial Rating – Product Review & Rating System plugin for WordPress. Because the plugin fails to perform adequate input sanitization and output escaping, an attacker with administrator privilege can store malicious JavaScript in that field. When other site users view the page that incorporates the stored value, the injected script runs, enabling arbitrary code execution within the context of the user’s browser, potentially exposing session information or facilitating session hijacking.

All installations of Editorial Rating versions 4.0.5 and earlier are affected. Administrators of any site running these versions can exploit the flaw; users who view pages containing the malicious Link URL are rendered vulnerable for the duration of their session.

The CVSS score of 4.4 indicates moderate severity. The EPSS score is not available, and because the flaw requires administrator credentials and does not rely on public network traffic, the likelihood of exploitation is low on public-facing sites where such access is restricted. The vulnerability is not listed in CISA KEV, yet attackers could still benefit from internal administrator access or compromised administrator accounts. The attack path is straightforward for those with sufficient privileges: they input a payload into the Link URL field, the plugin stores it, and the payload is rendered when a page is viewed by any user.