Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

Rating by BestWebSoft Object Injection Vulnerability

CVE-2025-39527 · published 1 year ago
Summary

A security weakness in Rating by BestWebSoft allows an attacker to inject malicious code. This affects all versions of the plugin from 1.0 to 1.7. To stay secure, update to the latest version or uninstall and replace with a trusted alternative.

Original advisory text
Deserialization of Untrusted Data vulnerability in bestweblayout Rating by BestWebSoft rating-bws allows Object Injection.This issue affects Rating by BestWebSoft: from n/a through <= 1.7.
Deserialization of Untrusted Data vulnerability in bestweblayout Rating by BestWebSoft rating-bws allows Object Injection.This issue affects Rating by BestWebSoft: from n/a through <= 1.7.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-502Deserialization of Untrusted Data
Timeline
Published17 Apr 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-39527 · NVD
Track software like this
Free during beta