The kk Star Ratings – Rate Post & Collect User Feedbacks plugin for WordPress allows an attacker to pass an arbitrary payload to the do_shortcode function without validation, enabling the execution of any shortcode. This flaw can be leveraged by unauthenticated users to run custom code on the site, potentially leading to a full remote code execution scenario on the hosting environment.

Any WordPress site that has the kk Star Ratings plugin installed with a version up to and including 5.4.10.3 is affected. The vulnerability exists in all releases of the plugin prior to 5.4.10.4 and is documented in the plugin’s source code where the payload parameter is handled.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score is not available, so the likelihood of exploitation cannot be quantified from the available data. The vulnerability is listed as unauthenticated, implying that the attack vector is via a publicly reachable AJAX endpoint that processes the payload without checking the user’s identity. Because it is not included in the CISA KEV catalog, there is no evidence of known exploitation yet, but the potential for arbitrary code execution makes it a high‑risk target for automated exploitation attempts if a newer unpatched version is not deployed.