Security Alert Summary
The CBX 5 Star Rating & Review plugin for WordPress contains a reflected Cross-Site Scripting (XSS) vulnerability in the handling of the page parameter. Insufficient input sanitization and output escaping make it possible for an unauthenticated attacker to inject script content that executes if an administrator is tricked into clicking a crafted link.
CVE Details
- CVE ID:
CVE-2026-6864 - Affected plugin: CBX 5 Star Rating & Review plugin for WordPress
- Affected versions: All versions up to, and including, 1.0.7
- Published: May 22, 2026 at 05:16:27 AM
- Last modified: May 22, 2026 at 05:16:27 AM
- CVSS v3.1 base score: 6.1 (MEDIUM) —
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Attack vector / complexity: Network / Low
- Privileges required: None
- User interaction: Required
- Scope: Changed
- Primary impact: Confidentiality: Low; Integrity: Low; Availability: None
- Weakness: CWE-79 (Improper Neutralization of Input During Web Page Generation [Cross-site Scripting])
Technical Details
The plugin fails to properly sanitize and escape the page parameter in administrative pages. This reflected XSS vulnerability allows an attacker to craft a URL containing malicious script code in the page parameter. If an administrator follows that URL, the injected script can execute in the administrator’s browser context.
Files referenced in public analysis indicate the issue is present in the plugin’s admin template files such as admin-rating-review-rating-avg-logs.php and admin-rating-review-review-logs.php in the plugin templates directory. The vulnerability exists because input is not sufficiently validated or escaped before being output to the page.
Impact is limited to what can be achieved via script execution in an administrator’s browser. The vulnerability does not itself require authentication, but it does require an administrator to interact with a crafted link for the payload to execute.
How This Could Impact Your Website
Consider a site with multiple roles: a site owner, internal staff who manage content, and an external contractor who occasionally performs updates. An attacker could send a crafted link to an administrator or post it in a location likely to be clicked. If an administrator clicks the link, the injected script could run in their browser and potentially access sensitive data visible to that admin account, perform actions available to the admin in the browser session, or exfiltrate information shown in admin pages.
Practical consequences include exposure of internal user email addresses and other admin-visible data, and an increased risk of targeted phishing or social engineering against staff and contractors who can perform administrative tasks. The vulnerability requires user interaction by an admin, so it does not by itself enable remote, automatic takeover of the site without further steps by an attacker.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor and administrator roles assigned to external contractors.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site and admin activity logs for unusual behavior, including unexpected admin page accesses or unusual links clicked by administrative users.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/cbxscratingreview/tags/1.0.7/templates/admin/admin-rating-review-rating-avg-logs.php#L41
- https://plugins.trac.wordpress.org/browser/cbxscratingreview/tags/1.0.7/templates/admin/admin-rating-review-review-logs.php#L41
- https://plugins.trac.wordpress.org/browser/cbxscratingreview/tags/1.0.8/templates/admin/admin-rating-review-rating-avg-logs.php
- https://plugins.trac.wordpress.org/browser/cbxscratingreview/tags/1.0.8/templates/admin/admin-rating-review-review-logs.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/9ee11e19-21a6-45df-a118-f6dec3b55bc1?source=cve
