EC Stars Rating
EC Stars Rating has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it remains unpatched as of September 2026. Their average CVSS score is 4.4, and the most serious one scores 4.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for EC Stars Rating has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.
All of these findings were reported by Nguyen Ngoc Quang Bach (maysbachs). EC Stars Rating is installed on roughly 300 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 4.3.34.
CVE-2025-53296EC Stars Rating <= 1.0.11 - Authenticated (Administrator+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records
EC Stars Rating
Author
ecoal95
A super fast WordPress star rating plugin, optimized for SEO, and with a really low impact on page load (just CSS + a bit of HTML, plus the strictly required JS for working). Developers The svn repo has been recently synchronized with a github one. Contributions are more than welcome, so feel free to submit a PR there if you wish 🙂 How it works Basically we create a new table called (prefix)ec_stars_votes, where we store the votes of the people (to prevent duplicate votes). The number of votes and the sum of the total votes are stored in the (prefix)options table in form of custom meta fields, one for the count, and another for the sum. Both fields get updated when someone votes.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C