title: WP Postratings < 1.86.1 - Admin+ Stored Cross-Site Scripting
description: The WP-PostRatings WordPress plugin before 1.86.1 does not sanitise the postratings_image parameter from its options page (wp-admin/admin.php?page=wp-postratings/postratings-options.php). Even though the page is only accessible to administrators, and protected against CSRF attacks, the issue is still exploitable when the unfiltered_html capability is disabled.
problem types: CWE-79 Cross-Site Scripting (XSS)
affected:
{
vendor: Unknown
product: WP-PostRatings
versions:
status: affected, versionType: semver, version: 0, lessThan: 1.86.1
defaultStatus: unaffected
collectionURL: https://wordpress.org/plugins
}