CVE-2021-25117: Lesterchan Wp-Postratings

Medium severity, CVSS 4.8. EPSS: 0.2% chance of exploitation in the next 30 days.

The WP-PostRatings WordPress plugin before 1.86.1 does not sanitise the postratings_image parameter from its options page (wp-admin/admin.php?page=wp-postratings/postratings-options.php). Even though the page is only accessible to administrators, and protected against CSRF attacks, the issue is still exploitable when the unfiltered_html capability is disabled.

Affected products

• Lesterchan Wp-Postratings: before 1.86.1 (fixed in 1.86.1)

Published 2024-01-16. Last modified 2026-06-17.