CVE-2026-3424

5.3 Moyenne

Publiée le 22/08/2026 à 14:16 · Modifiée le 12/10/2026 à 18:10 · Analyse NVD reportée · Source : security@wordfence.com

Description

The The kk Star Ratings – Rate Post & Collect User Feedbacks plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.4.10.3. This is due to the software allowing users to execute an action that does not properly validate the 'payload' value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

Traduire en français

Produits concernés

properfraction kk Star Ratings – Rate Post & Collect User Feedbacks

Scores CVSS

Version	Score	Source	Vecteur
3.1	5.3 Moyenne	security@wordfence.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N`

Faiblesses (CWE)

CWE-94

Références

https://plugins.trac.wordpress.org/browser/kk-star-ratings/trunk/src/core/functions/scripts/main.php#L36
https://plugins.trac.wordpress.org/browser/kk-star-ratings/trunk/src/core/wp/actions/wp_ajax_kk-star-ratings.php#L85
https://plugins.trac.wordpress.org/browser/kk-star-ratings/trunk/src/core/wp/actions/wp_ajax_kk-star-ratings.php#L88
https://plugins.trac.wordpress.org/changeset/3474555/
https://www.wordfence.com/threat-intel/vulnerabilities/id/0b2e9103-16a8-4350-97ee-ae05a90850f6?source=cve

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories