The WP Emoticon Rating plugin contains a CSRF vulnerability caused by missing or incorrect nonce validation. An unauthenticated attacker can submit a forged request that updates the "emo_settings" parameter with arbitrary content. When the site administrator later accesses the settings page, the injected content is reflected back into the browser and executed, leading to cross‑site scripting within the admin context.

Any WordPress installation that has the WP Emoticon Rating plugin from vendor rahulbhangale, versions 1.0.1 or earlier.

The CVSS score of 6.1 indicates moderate severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, implying no known widespread exploitation. The attack requires a social‑engineering link that causes an administrator to unknowingly send the forged request, after which the attacker can trigger script execution in the administrator's browser.