CVE-2026-93430 in GD Rating System Plugin
Summary
by MITRE • 10/03/2026
The GD Rating System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'title' and 'url' Render Args in gdrts_live_handler AJAX in all versions up to, and including, 3.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Although the AJAX action requires a per-item nonce, that nonce is publicly emitted in the page's <script class="gdrts-rating-data"> JSON block on every page rendering the rating item, making it obtainable by any unauthenticated visitor and therefore not an authentication barrier.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/03/2026
The GD Rating System plugin for WordPress contains a critical security vulnerability affecting all versions up to and including 3.7.1 that allows for Stored Cross-Site Scripting attacks through the gdrts_live_handler AJAX endpoint. This flaw stems from insufficient input sanitization and output escaping mechanisms when processing data passed via the title and url render arguments. The nature of this vulnerability classifies it under CWE-80, which addresses Improper Neutralization of Script-Related HTML Tags in a Web Page, commonly known as Basic XSS. Because the malicious scripts are stored within the application's database or configuration rather than being transiently injected through URL parameters, they persist and execute automatically whenever any user views the affected page, significantly increasing the potential impact compared to reflected variants.
The operational mechanism of this exploit relies on the attacker injecting arbitrary web scripts into the title or url fields during a rating interaction. While the plugin implements security measures such as per-item nonces intended to prevent unauthorized actions, these safeguards are rendered ineffective by a design flaw in how they are exposed to clients. The nonce required for authentication is publicly emitted within the page source code inside a JSON block labeled with the class gdrts-rating-data on every page that renders a rating item. This exposure allows any unauthenticated visitor to retrieve the valid nonce simply by inspecting the HTML or JavaScript of the target website, thereby bypassing what was intended to be an authentication barrier and enabling them to craft legitimate-looking AJAX requests that execute arbitrary code.
From a threat intelligence perspective, this vulnerability aligns with MITRE ATT&CK technique T1059.007, which covers Command and Scripting Interpreter via JavaScript in the context of web applications. The ability for unauthenticated attackers to inject scripts means they can perform actions such as stealing session cookies, hijacking user sessions, defacing websites, or redirecting users to malicious sites. Since the execution occurs on every page load where the rating widget is present, a single successful injection can compromise multiple visitors without requiring further interaction from them beyond viewing the compromised content. This persistence makes remediation urgent and critical for maintaining the integrity of WordPress-based platforms utilizing this plugin.
Mitigation strategies should prioritize immediate updates to version 3.7.2 or later if available, as these versions likely address the input validation and nonce handling issues described. In cases where updating is not immediately feasible, administrators can implement server-side rules using a Web Application Firewall to block requests containing script tags in the title and url parameters for the gdrts_live_handler endpoint. Additionally, modifying the plugin code to ensure that all output is properly escaped using WordPress functions like esc_html or wp_json_encode before rendering, and ensuring nonces are not exposed in client-accessible JSON structures, can restore security boundaries. Regular audits of third-party plugins for proper sanitization practices are essential to prevent similar vulnerabilities from being introduced into the environment.