CVE-2026-93430

{
  "etk_id": "ETK-2026-451",
  "cve_id": "CVE-2026-93430",
  "display_id": "CVE-2026-93430",
  "ghsa_id": "GHSA-2fcm-3887-5h6p",
  "euvd_id": "EUVD-2026-91922",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Stored cross-site scripting in GD Rating System",
  "summary": "GD Rating System for WordPress through version 3.7.1 improperly handles certain AJAX render arguments, allowing stored script content to be placed into affected pages. An unauthenticated attacker can abuse the issue when rating items are publicly rendered, because the required per-item nonce is exposed to page visitors.",
  "mitigation": "Disable the plugin or restrict public access to pages that render rating items until you can install a vendor release confirmed to address this issue. Treat exposed per-item nonces as public values rather than access control.",
  "vendor": "gdragon",
  "product": "GD Rating System",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 3.7.1"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "GD Rating System",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 7.2,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
  "epss_score": 0.0027,
  "epss_percentile": 0.1836,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 25.708254183333334,
  "t0_at": "2026-10-03T05:29:14.760000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-03T05:29:14.760000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-03T05:29:14.760000+00:00",
      "url": "https://github.com/advisories/GHSA-2fcm-3887-5h6p"
    }
  }
}