CVE-2026-93430 describes a stored XSS vulnerability in the GD Rating System WordPress plugin (versions up to and including 3.7.1). The flaw exists in the handling of 'title' and 'url' render arguments within the gdrts_live_handler AJAX endpoint. Due to improper neutralization of input (CWE-79), attackers can inject arbitrary JavaScript that executes in the context of users visiting pages with the injected content. The nonce intended to protect the AJAX action is exposed in a JSON block on every page rendering the rating item, making it accessible to unauthenticated users and thus ineffective as an authentication barrier.

An unauthenticated attacker can inject persistent malicious scripts into pages rendered by the GD Rating System plugin. These scripts execute in the browsers of users who visit the affected pages, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability has a CVSS 3.1 score of 7.2 (high severity), reflecting its network attack vector, low attack complexity, no privileges required, no user interaction needed, and impact on confidentiality and integrity with no impact on availability.

No official patch or fix is currently documented. Users should monitor the vendor's advisory channels for updates. Until a fix is available, consider disabling or removing the GD Rating System plugin if feasible. Additionally, review and sanitize any user-generated content related to 'title' and 'url' fields to prevent injection. Since the nonce is publicly exposed and ineffective, relying on it for protection is not recommended.