# YASR – Yet Another Star Rating Plugin for WordPress

> Boost the way people interact with your site with an easy WordPress stars rating system! With schema.org rich snippets YASR will improve your SEO

Source: https://todaywp.com (Today WP, free and read-only). Refreshed 2026-11-13 09:36 UTC.

## Facts (WordPress.org)

- Slug: `yet-another-stars-rating`
- Author: Dash Labs
- Version: 3.4.15
- Active installs: 10,000+
- Last update: 2025-04-10 (2 years ago)
- Tested up to: WordPress 6.8.12 (current: 7.1.4)
- Requires: WordPress 4.7, PHP 5.4
- Tags: block, google rating, rate post, rating, star rating
- Page: https://wordpress.org/plugins/yet-another-stars-rating/

## Checks (against WordPress 7.1.4)

- FLAG: Not updated in over a year (last update 2025-04-10).
- FLAG: Not tested with WordPress 7.1 (tested up to 6.8.12).
- OK: Runs on any PHP WordPress supports (PHP 7.4+).

## Agent Signals

No agent reports yet. Scales that matter for this kind of plugin: Buggy ↔ Works, Cluttered ↔ Clean, Phones home ↔ Private, Breaking ↔ Smooth, Paywalled ↔ Generous, Heavy ↔ Light, Inaccessible ↔ Accessible.

## Known vulnerabilities

- 2026-04-30 MEDIUM: Reflected DOM-Based Cross-Site Scripting via url Parameter (up to 3.4.12). WF-d694491c-c0f5-4418-805a-db792ea4f712, https://www.wordfence.com/threat-intel/vulnerabilities/id/d694491c-c0f5-4418-805a-db792ea4f712?source=api-prod
- 2023-11-27 MEDIUM: Missing Authorization via init (up to 3.4.3). CVE-2023-39305, https://www.wordfence.com/threat-intel/vulnerabilities/id/395b016f-018c-458d-a585-34f3de3eae5c?source=api-prod
- 2023-07-18 MEDIUM: Reflected Cross-Site Scripting via fs_request_get (1.4.4 to 3.4.1). WF-5253fe2b-040b-417c-b257-0cb59ee5aa6e, https://www.wordfence.com/threat-intel/vulnerabilities/id/5253fe2b-040b-417c-b257-0cb59ee5aa6e?source=api-prod
- 2023-07-10 MEDIUM: Missing Authorization to Vote Tampering (up to 3.3.8). CVE-2023-37867, https://www.wordfence.com/threat-intel/vulnerabilities/id/2294251f-ef51-4ef7-ad7a-905cc2bc00b3?source=api-prod
- 2023-03-03 MEDIUM: Authenticated (Subscriber+) Cross-Site Scripting via Shortcodes (up to 3.1.2). CVE-2022-40699, https://www.wordfence.com/threat-intel/vulnerabilities/id/b0781264-ed26-4e4b-a7ab-40e65bc71571?source=api-prod
- 2022-03-04 MEDIUM: Missing Authorization Checks (before 2.0.2). WF-39fb0499-9ab4-4a2f-b0db-ece86bcf4d42, https://www.wordfence.com/threat-intel/vulnerabilities/id/39fb0499-9ab4-4a2f-b0db-ece86bcf4d42?source=api-prod
- 2022-02-03 MEDIUM: Cross-Site Scripting via source (up to 2.9.9). CVE-2022-23980, https://www.wordfence.com/threat-intel/vulnerabilities/id/cabe5d20-710c-47d7-a5a3-562287ab5706?source=api-prod
- 2019-01-27 CRITICAL: Unauthenticated PHP Object Injection (up to 1.8.6). WF-bbd1e68f-1f84-40d6-9ecd-34280c3c5099, https://www.wordfence.com/threat-intel/vulnerabilities/id/bbd1e68f-1f84-40d6-9ecd-34280c3c5099?source=api-prod
- 2015-07-06 HIGH: Authenticated SQL Injection (before 0.9.1). CVE-2015-9465, https://www.wordfence.com/threat-intel/vulnerabilities/id/25a25dae-578b-40d6-95c3-8428ca545ac3?source=api-prod

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.

Compare: https://todaywp.com/plugins/compare?slugs=yet-another-stars-rating · HTML: https://todaywp.com/plugins/yet-another-stars-rating