High · 8.8 CVE-2025-39527 EUVD-2025-11739GHSA-wwj8-vw56-c53c

WordPress Rating by BestWebSoft plugin <= 1.7 - PHP Object Injection Vulnerability

Published Apr 17, 2025 · Updated Apr 28, 2026 · Assigned by Patchstack

Vendor: bestweblayout Product: Rating by BestWebSoft

Description

Deserialization of Untrusted Data vulnerability in bestweblayout Rating by BestWebSoft rating-bws allows Object Injection.This issue affects Rating by BestWebSoft: from n/a through <= 1.7.

Affected products

Vendor	Product	Affected	Fixed
bestweblayout	Rating by BestWebSoft	≤ 1.7	—

References

https://patchstack.com/database/Wordpress/Plugin/rating-bws/vulnerability/wordpress-rating-by-bestwebsoft-1-7-php-object-injection-vulnerability?_s_id=cve vdb-entry