plugin
23 known security issues reported for the Yet Another Stars Rating WordPress plugin. Most recent disclosed Apr 30, 2026.
Running Yet Another Stars Rating on your site? Check whether your installed version is affected.
Scan your site freeMultiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can succe...
[en] Missing Authorization vulnerability in YetAnotherStarsRating.com Yet Another Stars Rating allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Yet Another Stars Rating: from n/a through 3.4.3.
[en] The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4....
[en] Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in YetAnotherStarsRating.Com YASR – Yet Another Star Rating Plugin for WordPress.This issue affects YASR – Yet Another Star Rating Plugin for WordPress: from n/a through 3.3.8.
The Yet Another Stars Rating plugin for WordPress is vulnerable to unauthorized modification of data due to a missing check on the init function in versions up to, and including, 3.4.3. This makes it possible for unauthenticated attackers to vote on private or nonexistent posts.
The Freemius SDK for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘fs_request_get’ function in versions up to, and including, 2.5.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute...
The Yet Another Stars Rating plugin for WordPress is vulnerable to vote tampering in versions up to, and including, 3.3.8. This vulnerability can be utilized by unauthenticated users to vote repeatedly.
[en] Cross-Site Scripting (XSS) vulnerability in Dario Curvino Yasr – Yet Another Stars Rating plugin <= 3.1.2 versions.
The Yet Another Stars Rating plugin for WordPress is vulnerable to Cross-Site Scripting via shortcode in versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping. This makes it possible for subscriber-level to inject arbitrary web scripts in pages that will execute whenever a user...
The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. An...
The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. An...
Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability discovered in WordPress Yet Another Stars Rating plugin (versions < 3.0.2).
Sensitive Information Disclosure vulnerability discovered in WordPress Yet Another Stars Rating plugin (versions < 3.0.2).
[en] Cross-Site Scripting (XSS) vulnerability discovered in Yasr – Yet Another Stars Rating WordPress plugin (versions <= 2.9.9), vulnerable at parameter 'source'.
Cross-Site Scripting (XSS) vulnerability discovered in Yasr – Yet Another Stars Rating WordPress plugin (versions <= 2.9.9), vulnerable at parameter 'source'.
[en] The yet-another-stars-rating plugin before 0.9.1 for WordPress has yasr_get_multi_set_values_and_field SQL injection via the set_id parameter.
PHP Object Injection vulnerability found by Paul Dannewitz in WordPress Yet Another Stars Rating plugin (versions <= 1.8.6).
The Yet Another Stars Rating plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.8.6 via deserialization of untrusted input from the unserialize() function found in the yasr-shortcode-functions.php file. This allows unauthenticated attackers to inject a PHP Object. The additio...
The Yet Another Stars Rating plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.8.6 via deserialization of untrusted input from the unserialize() function found in the yasr-shortcode-functions.php file. This allows unauthenticated attackers to inject a PHP Object. The additio...
The yet-another-stars-rating plugin before 0.9.1 for WordPress has yasr_get_multi_set_values_and_field SQL injection via the set_id parameter.
Because of this vulnerability, remote authenticated users with 'publish_posts' role can execute arbitrary SQL commands. Update the plugin.
** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.
An unauthenticated PHP object injection in the "Yasr – Yet Another Stars Rating" WordPress plugin introduces a starting point for RCE and similiar high-severity vulnerabilities. As of 27.01.2019, the plugin has over 20.000 active installations and round about 500.000 downloads. A shortcode provided by t...
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free