CVE-2022-23980

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Cross-Site Scripting (XSS) vulnerability discovered in Yasr – Yet Another Stars Rating WordPress plugin (versions <= 2.9.9), vulnerable at parameter 'source'.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Dario Curvino	Yasr – Yet Another Stars Rating (WordPress plugin)	>= <= 2.9.9, <= 2.9.9

References

https://patchstack.com/database/vulnerability/yet-another-stars-rating/wordpress-yasr-yet-another-stars-rating-plugin-2-9-9-cross-site-scripting-xss-vulnerabilityThird Party Advisory
https://wordpress.org/plugins/yet-another-stars-rating/#developersRelease Notes, Third Party Advisory
https://patchstack.com/database/vulnerability/yet-another-stars-rating/wordpress-yasr-yet-another-stars-rating-plugin-2-9-9-cross-site-scripting-xss-vulnerabilityThird Party Advisory
https://wordpress.org/plugins/yet-another-stars-rating/#developersRelease Notes, Third Party Advisory

Timeline

Published: Feb 4, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-239814.3The vulnerability allows Subscriber+ level users to create brands in WordPress Perfect Brands for WooCommerce plugin (versions <= 2.0.4).CVE-2022-239827.5The vulnerability discovered in WordPress Perfect Brands for WooCommerce plugin (versions <= 2.0.4) allows server information exposure.CVE-2022-239838.8Cross-Site Request Forgery (CSRF) vulnerability leading to plugin Settings Update discovered in WP Content Copy Protection & No Right Click CVE-2022-239847.5Sensitive information disclosure discovered in wpDiscuz WordPress plugin (versions <= 7.3.11).CVE-2022-239857.8The affected product is vulnerable to an out-of-bounds write while processing project files, which allows an attacker to craft a project fil CVE-2022-239867.5SQL injection vulnerability in the phpUploader v1.2 and earlier allows a remote unauthenticated attacker to obtain the information in the da CVE-2022-239874.8The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape their Form Name, which could allow high privilege users CVE-2022-239886.1The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape submitted form data, allowing unauthenticated attacker CVE-2022-239897.5In Stormshield Network Security (SNS) before 3.7.25, 3.8.x through 3.11.x before 3.11.13, 4.x before 4.2.10, and 4.3.x before 4.3.5, a flood CVE-2022-23998.8Use after free in WebGPU in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially exploit heap corruption via a craf CVE-2022-239907.5Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.CVE-2022-239929.8XCOM Data Transport for Windows, Linux, and UNIX 11.6 releases contain a vulnerability due to insufficient input validation that could poten