CVE-2026-93430

The GD Rating System plugin for WordPress is vulnerable to stored cross-site scripting via 'title' and 'url' render args in gdrts_live_handler AJAX in versions up to and including 3.7.1. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. Although the AJAX action requires a per-item nonce, that nonce is publicly emitted in the page's JSON block on every page rendering the rating item.

The risk involves potential execution of malicious scripts in users' browsers, which could lead to data theft or further attacks. The attack can be performed by anyone without authentication because the nonce is publicly available.

Immediately update the GD Rating System plugin to the latest version with a fix. Also consider strengthening input validation in the AJAX handler.