CVE-2026-3424: kk Star Ratings <= 5.4.10.3 - Unauthenticated Arbitrary Shortcode Execution via 'payload' Parameter
The The kk Star Ratings – Rate Post & Collect User Feedbacks plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.4.10.3. This is due to the software allowing users to execute an action that does not properly validate the 'payload' value before running doshortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress plugin: kk Star Ratings – Rate Post & Collect User Feedbacksto a version that resolves this vulnerability.Fixed in 5.4.10.3 - Configuration
Update/install a fixed version of the kk Star Ratings – Rate Post & Collect User Feedbacks plugin so that the plugin properly validates the 'payload' parameter before calling do_shortcode. The vulnerability affects all versions up to and including 5.4.10.3.
WordPress do_shortcode payload validation for kk Star Ratings – Rate Post & Collect User Feedbacks = properly validate/whitelist the 'payload' parameter before executing do_shortcode
Event History
Frequently Asked Questions
What is the reported security impact beyond shortcode execution?
The CVSS vector reports low integrity impact, with no reported confidentiality or availability impact. The vulnerability is network-accessible, requires low attack complexity, and does not require privileges or user interaction.