CVE-2026-6864 Overview
CVE-2026-6864 is a Reflected Cross-Site Scripting (XSS) vulnerability in the CBX 5 Star Rating & Review plugin for WordPress. The flaw affects all versions up to and including 1.0.7. It exists because the plugin fails to sanitize input and escape output on the page parameter used in admin log templates. Unauthenticated attackers can craft malicious URLs that execute arbitrary JavaScript in the browser of any administrator who clicks the link. The issue is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).
Critical Impact
Successful exploitation lets an unauthenticated attacker execute arbitrary scripts in an administrator's browser session, enabling session theft, account takeover, or further site compromise.
Affected Products
- CBX 5 Star Rating & Review plugin for WordPress, versions up to and including 1.0.7
- Vulnerable template: templates/admin/admin-rating-review-rating-avg-logs.php
- Vulnerable template: templates/admin/admin-rating-review-review-logs.php
Discovery Timeline
- 2026-05-22 - CVE-2026-6864 published to NVD
- 2026-05-22 - Last updated in NVD database
Technical Details for CVE-2026-6864
Vulnerability Analysis
The vulnerability resides in two admin template files within the CBX 5 Star Rating & Review plugin: admin-rating-review-rating-avg-logs.php and admin-rating-review-review-logs.php. Both templates read the page query parameter and reflect its value back into rendered HTML output without applying sanitization or escaping. As a result, any script payload supplied in the URL is rendered as executable content in the administrator's browser. The reflected nature of the flaw requires user interaction, typically through a crafted link delivered via phishing or a malicious site.
Root Cause
The root cause is missing input sanitization combined with absent output escaping on the page GET parameter at line 41 of each affected template. WordPress provides helpers such as esc_attr(), esc_html(), and sanitize_text_field() for this purpose, but the plugin does not apply them before echoing the value into the page. This is a classic CWE-79 pattern in PHP-based admin views.
Attack Vector
An attacker crafts a URL pointing to the affected admin page with a malicious script embedded in the page parameter. The attacker delivers the link to an authenticated administrator via phishing email, chat, forum post, or external website. When the administrator clicks the link, their browser submits the request, the plugin reflects the unsanitized payload into the response, and the script executes under the WordPress admin origin. The script can then steal session cookies, create new admin users via REST API calls, or inject persistent backdoors. See the Wordfence Vulnerability Report and the WordPress Plugin File Analysis for the vulnerable code path.
Detection Methods for CVE-2026-6864
Indicators of Compromise
- Web server access logs containing requests to admin pages with page= values that include <script>, javascript:, onerror=, or URL-encoded variants such as %3Cscript%3E.
- Unexpected creation of new WordPress administrator accounts or modifications to existing user roles shortly after admin login activity.
- Outbound HTTP requests from administrator browsers to unfamiliar domains immediately after visiting plugin admin pages.
- Unauthorized changes to plugin or theme files, or new PHP files in wp-content/uploads/.
Detection Strategies
- Inspect HTTP request logs for the page parameter targeting admin-rating-review-rating-avg-logs.php or admin-rating-review-review-logs.php with script-like payloads.
- Deploy a Web Application Firewall (WAF) rule that flags reflected XSS patterns in WordPress admin query strings.
- Audit installed plugin versions across managed WordPress instances and flag CBX 5 Star Rating & Review at version 1.0.7 or earlier.
Monitoring Recommendations
- Forward WordPress access logs and PHP error logs to a centralized logging platform for retention and correlation.
- Alert on administrator session activity originating from new IP addresses or geolocations following clicks on external links.
- Track WordPress audit events for user role changes, plugin installs, and option updates that occur outside change windows.
How to Mitigate CVE-2026-6864
Immediate Actions Required
- Update the CBX 5 Star Rating & Review plugin to version 1.0.8 or later, which contains the fix for the affected templates.
- Force a password reset and session invalidation for all WordPress administrator accounts as a precaution.
- Review the user list for unauthorized administrator accounts and review recent plugin and theme file modifications.
Patch Information
The vendor addressed the issue in version 1.0.8. The patched templates are visible in the WordPress plugin repository at admin-rating-review-rating-avg-logs.php (1.0.8) and admin-rating-review-review-logs.php (1.0.8). Apply the update through the WordPress plugins dashboard or via WP-CLI.
Workarounds
- If immediate patching is not possible, deactivate the CBX 5 Star Rating & Review plugin until the update can be applied.
- Restrict access to /wp-admin/ to trusted IP ranges via web server configuration to reduce exposure to reflected XSS lures.
- Configure a Content Security Policy (CSP) header that disallows inline script execution on admin pages to limit payload impact.
# Update the vulnerable plugin using WP-CLI
wp plugin update cbxscratingreview --version=1.0.8
# Verify the installed version
wp plugin get cbxscratingreview --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
