CVE-2014-2838

no score yetEPSS 1.0%

dev4press gd star rating: no CVSS score yet. EPSS 1.0% chance of exploitation in the next 30 days.

Multiple cross-site request forgery (CSRF) vulnerabilities in the GD Star Rating plugin 19.22 for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct (1) SQL injection attacks via the s parameter in the gd-star-rating-stats page to wp-admin/admin.php or (2) cross-site scripting (XSS) attacks via unspecified vectors.

EPSS: 1.0% chance of exploitation in the next 30 days; higher than 63% of CVEs (scores of 2026-10-31)
CWE: CWE-352
Published: 2015-01-12
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

dev4press:gd_star_rating

References

http://seclists.org/fulldisclosure/2014/Mar/399
http://secunia.com/advisories/57667
https://advisories.dxw.com/advisories/csrf-and-blind-sql-injection-in-gd-star-rating-1-9-22/
https://exchange.xforce.ibmcloud.com/vulnerabilities/92156
http://seclists.org/fulldisclosure/2014/Mar/399

Check your stack JSON