The Post Rating and Review plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input in the 'class' parameter. Authenticated attackers with Contributor-level privileges or above can inject arbitrary JavaScript code that is stored and executed in the context of users visiting the compromised pages. This vulnerability affects all plugin versions up to 1.3.4. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, required privileges at the contributor level, no user interaction, and impacts on confidentiality and integrity with no availability impact. There is no vendor advisory or patch link provided, and no known exploits in the wild have been reported.

Successful exploitation allows an authenticated user with Contributor-level access or higher to inject persistent malicious scripts into pages generated by the plugin. These scripts execute in the browsers of users who visit the affected pages, potentially leading to unauthorized actions such as session hijacking or data theft. The impact affects confidentiality and integrity but does not affect availability. Since the attacker must be authenticated with at least Contributor privileges, the risk is limited to environments where such user roles exist.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider restricting Contributor-level access or higher to trusted users only. Monitoring and reviewing user-generated content for suspicious input may help mitigate risk. Avoid using the affected plugin versions if possible or disable the plugin until a patch is available.