Medium severity · published Aug 22, 2026
CVE-2026-3424
kk Star Ratings <= 5.4.10.3 - Unauthenticated Arbitrary Shortcode Execution via 'payload' Parameter
5.3
CVSS
0.5%
EPSS
No
On KEV
Description
The The kk Star Ratings – Rate Post & Collect User Feedbacks plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.4.10.3. This is due to the software allowing users to execute an action that does not properly validate the 'payload' value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KS
kk Star Ratings – Rate Post & Collect User Feedbacks · properfraction
through 5.4.10.3 · source: vendor
Affected product
KS
kk Star Ratings – Rate Post & Collect User Feedbacks
properfraction
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-3424
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-3424
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/kk-star-ratings/trunk/src/core/functions/scripts/main.php#L36
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/kk-star-ratings/trunk/src/core/wp/actions/wp_ajax_kk-star-ratings.php#L85
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/kk-star-ratings/trunk/src/core/wp/actions/wp_ajax_kk-star-ratings.php#L88
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset/3474555/
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/0b2e9103-16a8-4350-97ee-ae05a90850f6?source=cve
More from kk Star Ratings – Rate Post & Collect User Feedbacks
7.3
CVE-2024-11977
kk Star Ratings – Rate Post & Collect User Feedbacks <= 5.4.10 - Unauthenticated Arbitrary Shortcode Execution