Junglewise Threat Intelligence

CVE-2026-12560: wpqode Editorial Rating stored XSS in Link URL field

CVE-2026-12560 · Severity: medium · CVSS 4.4 · Published 2026-06-30

Executive brief

The Editorial Rating plugin for WordPress, which allows site owners to add product reviews and rating systems, contains a security flaw in how it handles web links. An authorized user with administrative access can inject malicious scripts into the 'Link URL' field of a review. When other users or visitors view the affected review page, these scripts will execute, potentially allowing for unauthorized actions or data theft.

Technical details

This vulnerability is a Stored Cross-Site Scripting (XSS) flaw residing in the 'Link URL' field of the Editorial Rating – Product Review & Rating System plugin. The root cause is the failure to properly sanitize input and escape output when handling the '_wpas_er_options' post meta via the 'update_post_meta' function. An authenticated attacker with administrator-level privileges can inject arbitrary JavaScript into this field. Because the payload is stored in post meta rather than standard post content, it bypasses the 'unfiltered_html' capability protections typically afforded to WordPress administrators. The injected script executes in the context of any user who visits the affected page. The vulnerability is present in all versions up to and including 4.0.5.

Affected products

  • wpqode Editorial Rating – Product Review & Rating System up to, and including, 4.0.5

Timeline

  • 2026-06-30: disclosed
  • 2026-06-30: advisory

References