CVE-2026-12560: Editorial Rating WordPress Plugin XSS Flaw

CVE-2026-12560 Overview

CVE-2026-12560 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Editorial Rating – Product Review & Rating System plugin for WordPress. The flaw affects all versions up to and including 4.0.5. It stems from insufficient input sanitization and output escaping on the Link URL field within the plugin's metabox options. Authenticated attackers holding administrator-level access or higher can inject arbitrary web scripts that execute when users visit affected pages.

Critical Impact
Stored JavaScript payloads persist in post meta and execute in the browser of any visitor to an injected page, enabling session theft, forced redirects, or admin action abuse within the WordPress site context.

Affected Products

Editorial Rating – Product Review & Rating System plugin for WordPress
All versions up to and including 4.0.5
WordPress sites permitting multiple administrator accounts or delegated admin roles

Discovery Timeline

2026-06-30 - CVE-2026-12560 published to the National Vulnerability Database (NVD)
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-12560

Vulnerability Analysis

The Editorial Rating plugin exposes a Link URL field through its wpas-framework metabox options interface. Values submitted through this field are stored in post meta under the _wpas_er_options key using WordPress's update_post_meta function. The plugin then renders these stored values on the public-facing product review templates without applying appropriate escaping functions such as esc_url or esc_attr.

Because the payload is stored in post meta rather than in post_content or post_excerpt, WordPress's unfiltered_html capability check does not gate the input. This design decision means every administrator, including those with the unfiltered_html capability revoked, can inject arbitrary scripts. The vulnerability requires high privileges and high attack complexity but produces a scope change, since injected scripts execute in the browser context of end users visiting the front-end product review pages.

Root Cause

The root cause is missing output escaping in the front-end rendering path. Code paths in class-average-score-public_display.php and the wpas-theme-1.php template output the stored Link URL value directly into HTML attributes without calling WordPress escaping helpers. The metabox handler in metabox-options.php also fails to sanitize the input on write, compounding the issue.

Attack Vector

An attacker with administrator credentials edits a product review post, submits a crafted payload in the Link URL field, and saves the post. The payload is persisted in the _wpas_er_options post meta entry. When any subsequent visitor loads the review page, the plugin renders the malicious value into the page's HTML, causing script execution in the visitor's browser session. See the Wordfence vulnerability report and the affected template code for the unescaped output location.

Detection Methods for CVE-2026-12560

Indicators of Compromise

Unexpected <script>, javascript:, or event-handler content stored within the _wpas_er_options post meta key
Front-end product review pages returning HTML containing script tags or JavaScript URI schemes in link href attributes
Outbound browser requests from site visitors to unfamiliar third-party domains originating on review pages

Detection Strategies

Query the wp_postmeta table for rows where meta_key = '_wpas_er_options' and inspect values for HTML markup, <script, on*=, or javascript: substrings
Review WordPress audit logs for edit_post and update_post_meta operations on posts using the Editorial Rating plugin
Scan the rendered HTML of product review pages with a headless browser or DOM parser to identify inline scripts sourced from plugin-controlled meta

Monitoring Recommendations

Enable a Web Application Firewall (WAF) rule set that inspects POST bodies to /wp-admin/post.php for XSS signatures targeting the _wpas_er_options field
Monitor administrator account creation, role changes, and unusual admin logins from new IP addresses or geographies
Alert on Content Security Policy (CSP) violation reports from front-end review pages to catch script execution attempts

How to Mitigate CVE-2026-12560

Immediate Actions Required

Audit all users with administrator or higher privileges and remove or downgrade unnecessary accounts
Inspect the _wpas_er_options post meta across all posts and remove any values containing HTML or script content
Deploy a WAF rule to block script payloads submitted to the plugin's metabox save handler until a patched release is applied

Patch Information

At the time of NVD publication, all versions up to and including 4.0.5 are affected. Site owners should monitor the Editorial Rating plugin page on WordPress.org and the Wordfence advisory for a fixed release and upgrade immediately when available. A proper fix must apply esc_url on output within wpas-theme-1.php and class-average-score-public_display.php, and esc_url_raw on save within metabox-options.php.

Workarounds

Restrict administrator accounts to trusted personnel and enforce multi-factor authentication for all admin logins
Deactivate the Editorial Rating plugin on production sites until a patched version is released if untrusted administrators exist
Deploy a strict Content Security Policy that disallows inline scripts on public review pages to blunt exploitation impact
Use a virtual patching WAF signature to sanitize the Link URL field parameter on submission

bash

# Configuration example: search for potentially injected payloads in post meta
wp db query "SELECT post_id, meta_value FROM wp_postmeta \
  WHERE meta_key = '_wpas_er_options' \
  AND (meta_value LIKE '%<script%' \
       OR meta_value LIKE '%javascript:%' \
       OR meta_value LIKE '%onerror=%');"