CVE-2025-6538: Post Rating And Review XSS Vulnerability

CVE-2025-6538 Overview

CVE-2025-6538 is a stored Cross-Site Scripting (XSS) vulnerability in the Post Rating and Review plugin for WordPress, developed by bourgesloic. The flaw affects all versions up to and including 1.3.4. It stems from insufficient input sanitization and output escaping on the class parameter. Authenticated users with Contributor-level access or higher can inject arbitrary JavaScript that executes in the browsers of visitors viewing the affected pages. The issue is classified under CWE-79.

Critical Impact
Authenticated contributors can persist arbitrary JavaScript into WordPress pages, enabling session theft, administrative account takeover, and malicious redirects when administrators or visitors load injected content.

Affected Products

Bourgesloic Post Rating and Review plugin for WordPress — all versions through 1.3.4
WordPress sites allowing Contributor-level accounts with the plugin installed
Multi-author WordPress deployments using Post Rating and Review

Discovery Timeline

2025-06-26 - CVE-2025-6538 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-6538

Vulnerability Analysis

The Post Rating and Review plugin accepts user-supplied data for the class parameter without properly sanitizing input or escaping output. Attackers with Contributor permissions can submit crafted values containing HTML and JavaScript payloads. The injected content is stored in the WordPress database and rendered on front-end pages whenever a visitor accesses the affected post. Because the payload executes in the context of the site origin, attackers can harvest session cookies, perform actions on behalf of authenticated administrators, or deliver secondary payloads to visitors.

Stored XSS is particularly impactful on WordPress because administrators routinely preview pending contributor submissions. A single injection can escalate to full site compromise once an administrator views the malicious content.

Root Cause

The root cause is missing input validation on the class parameter combined with the absence of output escaping functions such as esc_attr() when the value is written into HTML attributes. WordPress provides sanitization APIs for this purpose, but the plugin fails to apply them to the vulnerable parameter.

Attack Vector

Exploitation requires an authenticated account with at least Contributor privileges. The attacker submits a rating or review entry with a malicious class value containing script content. When the page containing the injected markup is rendered, the browser executes the payload. User interaction is required because a victim must load the affected page. For technical specifics, see the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-6538

Indicators of Compromise

Unexpected <script> tags, event handlers (onerror, onload), or javascript: URIs stored in post metadata associated with the Post Rating and Review plugin
Outbound requests from visitor browsers to unfamiliar domains after loading posts with ratings
New or modified administrator accounts following contributor activity on the affected site

Detection Strategies

Audit the wp_postmeta and plugin-specific tables for values containing HTML or JavaScript syntax in the class field
Review WordPress audit logs for Contributor-level accounts submitting unusual rating or review payloads
Deploy a Web Application Firewall (WAF) ruleset that flags XSS patterns in requests to plugin endpoints

Monitoring Recommendations

Monitor web server access logs for POST requests to plugin AJAX or REST endpoints containing encoded script content
Track Content Security Policy (CSP) violation reports for inline script execution on pages that render ratings
Alert on creation of new Contributor accounts followed by immediate rating or review submissions

How to Mitigate CVE-2025-6538

Immediate Actions Required

Update the Post Rating and Review plugin to a version later than 1.3.4 as soon as a patched release is available from the vendor
Audit existing Contributor and Author accounts and remove any that are inactive or unverified
Review all stored ratings and reviews for malicious payloads and purge affected entries

Patch Information

At the time of publication, verify the current status on the WordPress Plugin Documentation and the Wordfence Vulnerability Report. Apply the fixed version through the WordPress plugin updater or by replacing the plugin files manually.

Workarounds

Deactivate the Post Rating and Review plugin until a patched version is installed
Restrict Contributor-level account creation and require administrator approval for new submissions
Implement a strict Content Security Policy that blocks inline script execution on front-end pages
Deploy a WAF rule to filter requests containing script tags or event-handler attributes targeting the plugin

bash

# Example Content Security Policy header to mitigate stored XSS execution
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'"