PT-2026-42726 · WordPress · Cbx 5 Star Rating & Review

Published 2026-05-22 · Updated 2026-05-22 · CVE-2026-6864

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions CBX 5 Star Rating & Review versions prior to 1.0.8

Description The CBX 5 Star Rating & Review plugin for WordPress is subject to Reflected Cross-Site Scripting (XSS), a flaw where an application includes untrusted data in a web page without proper validation. This occurs due to insufficient input sanitization and output escaping in the page parameter. Unauthenticated attackers can exploit this by injecting arbitrary web scripts into pages, which execute when an administrator is tricked into clicking a malicious link.

Recommendations Update the plugin to a version later than 1.0.7. As a temporary workaround, restrict or monitor the use of the page parameter to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-6864

Affected Products

Cbx 5 Star Rating & Review

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-6864 · Security Note
• https://plugins.trac.wordpress.org/browser/cbxscratingreview/tags/1.0.8/templates/admin/admin-rating-review-rating-avg-logs.php · Note
• https://plugins.trac.wordpress.org/browser/cbxscratingreview/tags/1.0.8/templates/admin/admin-rating-review-review-logs.php · Note
• https://plugins.trac.wordpress.org/browser/cbxscratingreview/tags/1.0.7/templates/admin/admin-rating-review-rating-avg-logs.php#L41 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/9ee11e19-21a6-45df-a118-f6dec3b55bc1?source=cve · Note
• https://plugins.trac.wordpress.org/browser/cbxscratingreview/tags/1.0.7/templates/admin/admin-rating-review-review-logs.php#L41 · Note
• https://twitter.com/CVEnew/status/2057783180187382001 · Twitter Post