Known vulnerabilities in YASR – Yet Another Star Rating Plugin for WordPress

Boost the way people interact with your site with an easy WordPress stars rating system! With schema.org rich snippets YASR will improve your SEO

8Reported vulnerabilities

9.8Highest CVSS score

3.4.15Latest version

10,000+Active installs

What to do now

Update YASR – Yet Another Star Rating Plugin for WordPress to 3.3.9 or later. 8 of these have a fixed version available. Updating resolves them.

Plugin last updated: April 10, 2025 / Tested up to WordPress: 6.8.8 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
CVE-2015-9465	High 8.8	1.9%	Before 0.9.1	`0.9.1`	October 10, 2019
WF-bbd1e68f-1f84-40d6-9ecd-34280c3c5099	Critical 9.8	—	1.8.6 and earlier	`1.8.7`	January 27, 2019
CVE-2023-37867	High 8.1	0.4%	Before 3.3.9	`3.3.9`	November 30, 2023
CVE-2022-40699	Medium 6.4	0.4%	3.1.2 and earlier	`3.1.3`	March 3, 2023
CVE-2022-4974	Medium 6.3	0.4%	Before 2.0.2	`2.0.2`	March 4, 2022
CVE-2022-23980	Medium 6.1	0.8%	2.9.9 and earlier	`3.0.0`	February 4, 2022
CVE-2023-33999	Medium 6.1	0.3%	1.4.4 to 3.4.1 (inclusive)	`3.4.2`	July 18, 2023
CVE-2023-39305	Medium 5.3	0.4%	3.4.3 and earlier	`3.4.4`	November 27, 2023

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.